EtwTracePool

VOID __stdcall EtwTracePool(UINT16 HookId, UINT64 PoolType, UINT64 Tag, VOID *Entry, UINT64 NumberOfBytes){
  unsigned int v6; 
  UINT16 v7; 
  int v8; 
  unsigned int v9; 
  NTSTATUS SessionId; 
  unsigned int v11; 
  bool i; 
  __int64 v13; 
  __int64 v14; 
  __int64 v15; 
  unsigned int v16; 
  unsigned int *v17; 
  int v18; 
  __int64 v19; 
  NTSTATUS v20; 
  int v21[2]; 
  UINT64 v22; 
  VOID *v23; 
  int *v24; 
  int v25; 
  int v26; 
  int *v27; 
  int v28; 
  int v29; 

  v20 = 0;
  v6 = Tag;
  v7 = HookId;
  if( NumberOfBytes > 0xFE0 )
  {
    v8 = PoolType & 0x26D | 0x10000000;
    v9 = 1;
    if( HookId == 3618 && (PoolType & 1) == 0 && MmIsNonPagedPoolNx(Entry) )
      v8 |= 0x200u;
    if( (v8 & 0x20) != 0 )
    {
      SessionId = MmGetSessionIdEx(KeGetCurrentThread()->ApcState.Process);
      v29 = 0;
      v9 = 2;
      v20 = SessionId;
      ++v7;
      v28 = 4;
      v27 = &v20;
    }
    v26 = 0;
    v24 = v21;
    v21[0] = v8;
    v21[1] = v6;
    v22 = NumberOfBytes;
    v23 = Entry;
    v25 = 24;
    v11 = *(_DWORD *)(EtwpHostSiloState + 4224);
    for( i = !_BitScanForward((unsigned int *)&v13, v11); !i; i = !_BitScanForward((unsigned int *)&v13, v11) )
    {
      v14 = (unsigned int)v13;
      v11 &= v11 - 1;
      v15 = 32 * v13 + EtwpHostSiloState + 4260;
      if( v15
        && (*(_DWORD *)(v15 + 4) & 0x40) != 0
        && (v16 = *((unsigned __int16 *)&ExBootDevicesRemovedEvent + 10 * (unsigned int)v13 + 880),
            *((_WORD *)&ExBootDevicesRemovedEvent + 10 * (unsigned int)v13 + 880)) )
      {
        v17 = (unsigned int *)((char *)&ExBootDevicesRemovedEvent + 20 * (unsigned int)v13 + 1764);
        while( !(unsigned int)ExCheckSingleFilter(v6, *v17) )
        {
          v17 = (unsigned int *)(v19 + 4);
          if( v18 + 1 >= v16 )
            goto LABEL_17;
        }
      }
      else
      {
LABEL_17:
        if( !v15 || (*(_DWORD *)(v15 + 4) & 1) == 0 )
          continue;
      }
      EtwpLogKernelEvent(
        (__int64)&v24,
        (_ETW_SILODRIVERSTATE *)EtwpHostSiloState,
        *(unsigned __int8 *)(EtwpHostSiloState + 2 * v14 + 4208),
        v9,
        v7,
        0x1401B02u);
    }
  }
}

Referenced by: