EtwRegisterEventCallback

INT64 __fastcall EtwRegisterEventCallback(UINT64 a1, INT64 a2, INT64 a3){
  unsigned int v5; 
  unsigned int v6; 
  _ETW_SILODRIVERSTATE *v7; 
  _ETHREAD *CurrentThread; 
  _WMI_LOGGER_CONTEXT *v9; 
  _QWORD *PoolWithTag; 
  v5 = a1;
  v6 = 0;
  v7 = (_ETW_SILODRIVERSTATE *)PsGetCurrentServerSiloGlobals()[108];
  if( !a2 || a2 != qword_140CFBB98 )
    return 3221225506i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  v9 = EtwpAcquireLoggerContextByLoggerId(v7, v5, 0);
  if( v9 )
  {
    PoolWithTag = ExAllocatePoolWithTag(NonPagedPoolNx, 0x10ui64, 0x43777445ui64);
    if( PoolWithTag )
    {
      PoolWithTag[1] = a3;
      if( _InterlockedCompareExchange64((volatile signed __int64 *)v9 + 159, (signed __int64)PoolWithTag, 0i64) )
      {
        v6 = -1073741811;
        ExFreePoolWithTag(PoolWithTag, 0);
      }
    }
    else
    {
      v6 = -1073741670;
    }
    EtwpReleaseLoggerContext((unsigned int *)v9, 0);
  }
  else
  {
    v6 = -1073741162;
  }
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  return v6;
}

Referenced by: