WmipLegacyEtwCallback

VOID __stdcall WmipLegacyEtwCallback(const _GUID *Guid, UINT64 ControlCode, VOID *EnableContext, VOID *Context){
  char v6; 
  int v7; 
  __int64 v8; 
  __int64 **v9; 
  __int64 **v10; 
  int v11; 
  VOID **PoolWithTag; 
  VOID **v13; 
  __int64 v14; 
  __int64 *i; 
  int v16; 
  INT64 v17; 
  int v18; 
  unsigned int v19; 

  if( (unsigned __int8)ControlCode <= 1u )
  {
    v6 = ControlCode;
    v7 = 0;
    KeWaitForSingleObject((UINT64)&ExBootDevicesRemovedEvent + 3072, 0, 0, 0, 0i64);
    if( *((_QWORD *)Context + 14) )
    {
      v8 = v6 ? *(_QWORD *)EnableContext : 0i64;
      v9 = (__int64 **)((char *)Context + 56);
      *((_QWORD *)Context + 15) = v8;
      v10 = (__int64 **)*((_QWORD *)Context + 7);
      if( v10 != (__int64 **)((char *)Context + 56) )
      {
        do
        {
          v11 = *((_DWORD *)v10 + 4);
          if( (v11 & 0x100000) != 0 && (v6 || (v11 & 0x200000) != 0) )
            ++v7;
          v10 = (__int64 **)*v10;
        }
        while( v10 != v9 );
        if( v7 )
        {
          PoolWithTag = ExAllocatePoolWithTag(1ui64, 8 * v7 + 40, 1885957463i64);
          v13 = PoolWithTag;
          if( PoolWithTag )
          {
            *((_DWORD *)PoolWithTag + 4) = 2;
            v14 = 0i64;
            PoolWithTag[3] = *(VOID **)EnableContext;
            *((_BYTE *)PoolWithTag + 36) = v6;
            *((_DWORD *)PoolWithTag + 8) = v7;
            for( i = *v9; i != (__int64 *)v9; i = (__int64 *)*i )
            {
              v16 = *((_DWORD *)i + 4);
              if( (v16 & 0x100000) != 0 && (v6 || (v16 & 0x200000) != 0) )
              {
                v17 = i[8];
                WmipReferenceEntry(v17);
                v13[v14 + 5] = (VOID *)v17;
                v14 = (unsigned int)(v14 + 1);
                v18 = *((_DWORD *)i + 4);
                if( v6 )
                  v19 = v18 | 0x200000;
                else
                  v19 = v18 & 0xFFDFFFFF;
                *((_DWORD *)i + 4) = v19;
              }
            }
            WmipQueueLegacyEtwWork(v13, (INT64)Context, 0i64);
          }
        }
      }
    }
    KeReleaseMutex((_KMUTANT *)((char *)&ExBootDevicesRemovedEvent + 3072), 0);
  }
}

Referenced by: