EmProviderRegisterEntry

__int64 __fastcall EmProviderRegisterEntry(__int64 a1, _QWORD *a2, __int64 a3, _QWORD *a4){
  _QWORD *v8; 
  int v9; 
  SINGLE_LIST_ENTRY *v10; 
  unsigned int v11; 
  __int64 v12; 
  _QWORD *v13; 
  __int64 v14; 
  void *v15; 
  _QWORD *PoolWithTag; 
  unsigned int v18; 
  UINT8 *v19; 
  _QWORD *v20; 
  _QWORD *v21; 
  _SINGLE_LIST_ENTRY *Next; 
  _SINGLE_LIST_ENTRY *v23; 
  _SINGLE_LIST_ENTRY *v24; 
  v8 = 0i64;
  v9 = 0;
  ExAcquirePushLockExclusiveEx((UINT64)&EmpDatabaseLock, 0i64);
  if( !a2 || !a1 || !a3 || !a4 || !*(_QWORD *)a3 || !*(_DWORD *)(a3 + 8) )
    goto LABEL_14;
  v10 = EmpSearchEntryDatabase((const GUID *)a2);
  if( !v10 )
  {
    v9 = -1073741275;
    goto LABEL_15;
  }
  v11 = *(_DWORD *)(a1 + 16);
  v12 = 0i64;
  if( v11 )
  {
    while( 1 )
    {
      v13 = *(_QWORD **)(*(_QWORD *)(a1 + 8) + 8 * v12);
      v14 = *v13 - *a2;
      if( *v13 == *a2 )
        v14 = v13[1] - a2[1];
      if( !v14 )
        break;
      v12 = (unsigned int)(v12 + 1);
      if( (unsigned int)v12 >= v11 )
        goto LABEL_14;
    }
    PoolWithTag = ExAllocatePoolWithTag(PagedPool, 0x38ui64, 0x72704D45ui64);
    v8 = PoolWithTag;
    if( PoolWithTag
      && (*PoolWithTag = v10,
          v18 = *(_DWORD *)(a3 + 8),
          *((_DWORD *)v8 + 4) = v18,
          v19 = (UINT8 *)ExAllocatePoolWithTag(PagedPool, v18, 0x72704D45ui64),
          (v8[1] = v19) != 0i64) )
    {
      memmove(v19, *(UINT8 **)a3, *((unsigned int *)v8 + 4));
      v20 = *(_QWORD **)(a1 + 64);
      v21 = v8 + 5;
      if( *v20 != a1 + 56
        || (*v21 = a1 + 56,
            v8[6] = v20,
            *v20 = v21,
            *(_QWORD *)(a1 + 64) = v21,
            Next = v10[6].Next,
            v23 = (_SINGLE_LIST_ENTRY *)(v8 + 3),
            Next->Next != &v10[5]) )
      {
        __fastfail(3u);
      }
      v23->Next = v10 + 5;
      v8[4] = Next;
      Next->Next = v23;
      v10[6].Next = v23;
      v24 = v10[9].Next;
      v10[4].Next = v23;
      while( v24 )
      {
        EmpQueueRuleUpdateState((__int64)v24[-1].Next, (__int64)v10);
        v24 = v24->Next;
      }
      *a4 = v8;
    }
    else
    {
      v9 = -1073741670;
    }
  }
  else
  {
LABEL_14:
    v9 = -1073741811;
  }
LABEL_15:
  if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&EmpDatabaseLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock((volatile INT64 *)&EmpDatabaseLock);
  KeAbPostRelease(&EmpDatabaseLock);
  if( v9 < 0 && v8 )
  {
    v15 = (void *)v8[1];
    if( v15 )
      ExFreePoolWithTag(v15, 0x72704D45u);
    ExFreePoolWithTag(v8, 0x72704D45u);
  }
  return(unsigned int)v9;
}

Referenced by: