AlpcRegisterLogRoutine

INT64 __stdcall AlpcRegisterLogRoutine(){
  _QWORD *PoolWithTag; 
  unsigned int v1; 
  _QWORD *v2; 
  VOID(__stdcall **i)(PVOID, UINT64); 
  _QWORD *v5; 
  PoolWithTag = ExAllocatePoolWithTag(PagedPool, 0x18ui64, 0x634C6C41ui64);
  v1 = 0;
  v2 = PoolWithTag;
  if( !PoolWithTag )
    return 3221225626i64;
  PoolWithTag[2] = EtwpTraceALPC;
  ExAcquirePushLockExclusiveEx((UINT64)&AlpcpLogLock, 0i64);
  for( i = (VOID(__stdcall **)(PVOID, UINT64))AlpcpLogCallbackListHead;
        i != (VOID(__stdcall **)(PVOID, UINT64))&AlpcpLogCallbackListHead;
        i = (VOID(__stdcall **)(PVOID, UINT64))*i )
  {
    if( i[2] == EtwpTraceALPC )
    {
      ExFreePoolWithTag(v2, 0);
      v1 = -1073740008;
      goto LABEL_11;
    }
  }
  v5 = off_140C0EC90;
  if( *(PVOID **)off_140C0EC90 != &AlpcpLogCallbackListHead )
    __fastfail(3u);
  *v2 = &AlpcpLogCallbackListHead;
  v2[1] = v5;
  *v5 = v2;
  off_140C0EC90 = v2;
  AlpcpLogEnabled = 1;
LABEL_11:
  if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&AlpcpLogLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock((volatile INT64 *)&AlpcpLogLock);
  KeAbPostRelease(&AlpcpLogLock);
  return v1;
}

Referenced by: