EtwpTraceMessageVa
NTSTATUS __stdcall EtwpTraceMessageVa(
UINT64 TraceHandle,
UINT64 MessageFlags,
_GUID *MessageGuid,
UINT16 MessageNumber,
PSTR MessageArgList,
INT8 RequestorMode){
char v6;
unsigned int v7;
PSTR v8;
unsigned __int64 v9;
char *v10;
_ETW_SILODRIVERSTATE *EtwSiloState;
_WMI_LOGGER_CONTEXT *v12;
_WMI_LOGGER_CONTEXT *v13;
unsigned int LoggerMode;
char v15;
char v16;
PSTR v17;
PSTR v18;
__int64 v19;
unsigned __int64 v20;
NTSTATUS result;
int v22;
int v23;
int v24;
int v25;
int v26;
unsigned int v27;
char *v28;
signed __int32 v29;
_WMI_LOGGER_CONTEXT *v30;
int *SequencePtr;
unsigned __int64 v32;
__int16 v33;
_GUID *v34;
signed __int32 *v35;
_ETHREAD *CurrentThread;
signed __int32 *v37;
PSTR v38;
char *v39;
unsigned __int64 v40;
int v41;
_WMI_LOGGER_CONTEXT *v42;
UINT64 Flags;
char v44;
char v45;
NTSTATUS v46;
_ETW_LOGGER_HANDLE LoggerHandle;
INT8 v48;
INT8 v49;
NTSTATUS v50;
signed __int32 *v51;
UINT16 v52;
unsigned int v53;
_ETW_SILODRIVERSTATE *v54;
PSTR v55;
PSTR v56;
char *v57;
UINT64 v58;
int v59;
int v60;
int v61;
int v62;
_LARGE_INTEGER TimeStamp;
char *v64;
_WMI_LOGGER_CONTEXT *LoggerContext;
_ETW_SILODRIVERSTATE *v66;
int UniqueThread;
int UniqueProcess;
_GUID *v69;
unsigned __int64 v70;
__int128 BufferHandle;
__int64 v72;
_ETHREAD *v73;
INT64 v74[2];
v52 = MessageNumber;
v69 = MessageGuid;
v6 = MessageFlags;
LOWORD(v7) = TraceHandle;
v58 = TraceHandle;
v8 = MessageArgList;
v48 = RequestorMode;
v49 = RequestorMode;
BufferHandle = 0i64;
v72 = 0i64;
LoggerHandle.DereferenceAndLeave = 0;
*(_OWORD *)v74 = 0i64;
v9 = 0i64;
v50 = 0;
v46 = 0;
TimeStamp.QuadPart = 0i64;
v10 = 0i64;
v57 = 0i64;
v64 = 0i64;
if( RequestorMode )
EtwSiloState = PsGetCurrentServerSiloGlobals((_KSPIN_LOCK *)TraceHandle)->EtwSiloState;
else
EtwSiloState = (_ETW_SILODRIVERSTATE *)EtwpHostSiloState;
v66 = EtwSiloState;
v54 = EtwSiloState;
v7 = (unsigned __int16)v7;
v53 = v7;
if( (unsigned __int16)v7 >= EtwSiloState->MaxLoggers )
return -1073741816;
v12 = EtwpOpenLogger((unsigned __int16)v7, EtwSiloState, RequestorMode, &LoggerHandle);
v13 = v12;
LoggerContext = v12;
if( !v12 )
return -1073741816;
LoggerMode = v12->LoggerMode;
if( (LoggerMode & 0x80u) != 0 )
{
result = -1073741790;
goto LABEL_100;
}
if( !RequestorMode && (LoggerMode & 0x1000000) != 0 )
{
result = -1073741637;
LABEL_100:
v46 = result;
goto LABEL_86;
}
v55 = 0i64;
v15 = v6 & 0x40;
v44 = v6 & 0x40;
v16 = v6 & 0x80;
v45 = v6 & 0x80;
if( (v6 & 0x40) != 0 )
{
v10 = &MessageArgList[HIDWORD(v58)];
v57 = v10;
v64 = v10;
}
v58 = 0i64;
v17 = MessageArgList;
v55 = MessageArgList;
while( 1 )
{
if( !v15 )
{
v18 = v17 + 8;
LABEL_13:
v19 = *((_QWORD *)v18 - 1);
goto LABEL_14;
}
if( !v16 )
{
v18 = v17 + 8;
if( v18 > v10 )
{
result = -1073741306;
v46 = -1073741306;
EtwSiloState = v54;
goto LABEL_86;
}
goto LABEL_13;
}
v18 = v17 + 4;
if( v18 > v10 )
{
result = -1073741306;
v46 = -1073741306;
EtwSiloState = v54;
goto LABEL_86;
}
v19 = *((unsigned int *)v18 - 1);
LABEL_14:
v55 = v18;
if( !v19 )
break;
if( v15 && v16 )
{
v17 = v18 + 4;
v20 = *((unsigned int *)v17 - 1);
}
else
{
v17 = v18 + 8;
v20 = *((_QWORD *)v17 - 1);
}
v55 = v17;
if( v20 )
{
v9 += v20;
v58 = v9;
if( v9 < v20 )
{
result = -1073741675;
v46 = -1073741675;
EtwSiloState = v54;
goto LABEL_86;
}
}
}
if( !v13->SequencePtr )
v6 &= ~1u;
v59 = v6 & 1;
v22 = 4;
if( (v6 & 1) != 0 )
v23 = 4;
else
v23 = 0;
v61 = v6 & 2;
if( (v6 & 2) != 0 )
v24 = 16;
else
v24 = 0;
v60 = v6 & 4;
if( (v6 & 4) == 0 )
v22 = 0;
v25 = 8;
if( (v6 & 0x18) != 0 )
v26 = 8;
else
v26 = 0;
v62 = v6 & 0x20;
if( (v6 & 0x20) == 0 )
v25 = 0;
v27 = v9 + v23 + v24 + v22 + v26 + v25 + 8;
if( v9 > v27 )
{
result = -1073741306;
LABEL_99:
EtwSiloState = v54;
goto LABEL_100;
}
LODWORD(Flags) = 0;
v28 = (char *)EtwpReserveTraceBuffer(v13, v27, (_ETW_BUFFER_HANDLE *)&BufferHandle, &TimeStamp, Flags);
v29 = 0;
v30 = LoggerContext;
SequencePtr = LoggerContext->SequencePtr;
if( SequencePtr )
{
v29 = _InterlockedIncrement(SequencePtr);
v9 = v58;
v50 = 0;
v15 = v44;
v32 = (unsigned __int64)v64;
v57 = v64;
v16 = v45;
}
else
{
v32 = (unsigned __int64)v57;
}
if( !v28 )
{
result = EtwpGetReserveTraceBufferStatus(v30, v27);
v7 = v53;
goto LABEL_99;
}
*(_DWORD *)v28 = -1879048192;
*(_WORD *)v28 = v27;
*((_WORD *)v28 + 2) = v52;
if( v16 )
v33 = 64;
else
v33 = 128;
*((_WORD *)v28 + 3) = v33 | v6 & 0x3F;
v34 = v69;
*(_GUID *)v74 = *v69;
v35 = (signed __int32 *)(v28 + 8);
v51 = v35;
if( v59 )
{
*v35++ = v29;
v51 = v35;
}
if( v60 )
{
*v35++ = v34->Data1;
LABEL_53:
v51 = v35;
}
else if( v61 )
{
*(_GUID *)v35 = *v34;
v35 += 4;
goto LABEL_53;
}
if( (v6 & 8) != 0 )
{
*(_LARGE_INTEGER *)v35 = TimeStamp;
v35 += 2;
v51 = v35;
}
if( v62 )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v73 = CurrentThread;
UniqueThread = (int)CurrentThread->Cid.UniqueThread;
v37 = v51;
*v51 = UniqueThread;
v51 = ++v37;
UniqueProcess = (int)CurrentThread->Cid.UniqueProcess;
*v37 = UniqueProcess;
v35 = v37 + 1;
v51 = v35;
v9 = v58;
v50 = 0;
v15 = v44;
v32 = (unsigned __int64)v64;
v57 = v64;
v16 = v45;
}
v70 = v9;
v56 = MessageArgList;
while( 1 )
{
do
{
if( v15 && v16 )
{
v38 = v8 + 4;
v39 = (char *)*((unsigned int *)v38 - 1);
}
else
{
v38 = v8 + 8;
v39 = (char *)*((_QWORD *)v38 - 1);
}
v56 = v38;
if( !v39 )
{
v41 = v50;
goto LABEL_81;
}
if( !v15 )
goto LABEL_66;
if( (unsigned __int64)v38 >= v32 )
{
v41 = -1073741306;
v50 = -1073741306;
v46 = -1073741306;
goto LABEL_81;
}
if( v16 )
{
v8 = v38 + 4;
v40 = *((unsigned int *)v8 - 1);
}
else
{
LABEL_66:
v8 = v38 + 8;
v40 = *((_QWORD *)v8 - 1);
}
v56 = v8;
}
while( !v40 );
if( v40 > v9 )
break;
if( v15 && ((unsigned __int64)&v39[v40] > 0x7FFFFFFF0000i64 || &v39[v40] < v39) )
MEMORY[0x7FFFFFFF0000] = 0;
memmove(v35, v39, v40);
v9 -= v40;
v70 = v9;
v35 = (signed __int32 *)((char *)v35 + v40);
v51 = v35;
v32 = (unsigned __int64)v57;
}
v41 = -1073741306;
v50 = -1073741306;
v46 = -1073741306;
LABEL_81:
EtwSiloState = v54;
if( v41 >= 0 )
{
v42 = LoggerContext;
if( (LoggerContext->LoggerMode & 0x80000) != 0
&& (!(_BYTE)KdDebuggerNotPresent && !KdPitchDebugger || KdEventLoggingPresent) )
{
EtwpSendTraceEvent(LoggerContext, (_ETW_BUFFER_HANDLE *)&BufferHandle);
v42 = LoggerContext;
}
if( v42->CallbackContext )
EtwpInvokeEventCallback((INT64)v42, (INT64)&BufferHandle, (INT64)v74);
}
EtwpReleaseTraceBuffer((_ETW_BUFFER_HANDLE *)&BufferHandle);
result = v50;
v7 = v53;
LABEL_86:
if( LoggerHandle.DereferenceAndLeave )
{
ExReleaseRundownProtectionCacheAwareEx((INT64)EtwSiloState->EtwpLoggerRundown[v7], 1i64);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
return v46;
}
return result;
}Referenced by:
NtTraceEvent
WmiTraceMessage
WmiTraceMessageVa