EtwpAddLogHeader
VOID __stdcall EtwpAddLogHeader(_WMI_LOGGER_CONTEXT *LoggerContext, _WMI_BUFFER_HEADER *Buffer){
BOOL IsWow64Logger;
__int64 v5;
unsigned __int16 v6;
_ETHREAD *CurrentThread;
_LARGE_INTEGER *p_StartPerfClock;
unsigned int UsedProcessorCount;
char v10;
char v11;
bool v12;
unsigned int ClockType;
_LARGE_INTEGER v14;
__int64 Length;
char *v16;
__int64 v17;
char *v18;
__int64 v19;
unsigned __int64 v20;
__m128i v21;
__int64 v22;
VOID *v23;
_LARGE_INTEGER *v24;
UINT64 v25;
_LARGE_INTEGER *v26;
_ETW_SILODRIVERSTATE *SiloState;
__int64 v28;
__int128 v29;
__int64 v30;
UINT64 Flags;
_LARGE_INTEGER PerformanceFrequency;
int v33;
VOID *v34;
__m128i v35;
__int64 v36;
unsigned int v37;
v33 = 0;
PerformanceFrequency.QuadPart = 0i64;
v36 = 0i64;
v37 = 0;
IsWow64Logger = EtwpIsWow64Logger((INT64)LoggerContext);
v6 = *(_WORD *)(v5 + 168) + *(_WORD *)(v5 + 152) + (IsWow64Logger ? 276 : 284);
if( LoggerContext->BufferSize >= (unsigned __int64)v6 + 104 )
{
if( ((int(__fastcall *)(__int64, __int64, __int64 *, int *))off_140C00A68[0])(25i64, 12i64, &v36, &v33) < 0 )
{
v36 = 0i64;
v37 = 0;
}
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
*((_WORD *)Buffer + 39) = 0;
p_StartPerfClock = &LoggerContext->ReferenceTime.StartPerfClock;
*((_WORD *)Buffer + 38) = v6 + 32;
*((_DWORD *)Buffer + 18) = -1073610750;
*((_DWORD *)Buffer + 20) = CurrentThread->Cid.UniqueThread;
*((_DWORD *)Buffer + 21) = CurrentThread->Cid.UniqueProcess;
*((_DWORD *)Buffer + 24) = CurrentThread->Tcb.SchedulerApc.SpareLong0;
*((_DWORD *)Buffer + 25) = CurrentThread->Tcb.UserTime;
*((_QWORD *)Buffer + 11) = LoggerContext->ReferenceTime.StartPerfClock.QuadPart;
memset((char *)Buffer + 104, 0i64, v6);
*((_DWORD *)Buffer + 26) = LoggerContext->BufferSize;
*((_WORD *)Buffer + 54) = 10;
*((_DWORD *)Buffer + 28) = (unsigned __int16)NtBuildNumber;
UsedProcessorCount = EtwpQueryUsedProcessorCount(LoggerContext);
*((_DWORD *)Buffer + 29) = UsedProcessorCount;
if( (LoggerContext->LoggerMode & 0x4000000) != 0
|| LoggerContext->BufferSize > 0x100000
|| UsedProcessorCount > 0x100 )
{
v10 = 0;
v11 = 2;
}
else
{
v10 = 5;
v11 = 1;
}
*((_BYTE *)Buffer + 110) = v11;
*((_BYTE *)Buffer + 111) = v10;
*((_DWORD *)Buffer + 36) = 1;
*((_DWORD *)Buffer + 34) = LoggerContext->LoggerMode & 0xFF3FFEFF;
*((_DWORD *)Buffer + 33) = LoggerContext->MaximumFileSize;
*((_DWORD *)Buffer + 32) = KeMaximumIncrement;
*((_DWORD *)Buffer + 39) = *(&ExBootDevicesRemovedEvent + 381);
KeQueryPerformanceCounter(&PerformanceFrequency);
_InterlockedExchange64((_QWORD *)&ExBootDevicesRemovedEvent + 189, PerformanceFrequency.QuadPart);
v12 = !EtwpIsWow64Logger((INT64)LoggerContext);
ClockType = 1;
v14 = PerformanceFrequency;
if( v12 )
{
*((_LARGE_INTEGER *)Buffer + 45) = PerformanceFrequency;
*((_QWORD *)Buffer + 46) = LoggerContext->ReferenceTime.StartTime.QuadPart;
*((_QWORD *)Buffer + 44) = *(&ExBootDevicesRemovedEvent + 244);
*((_DWORD *)Buffer + 37) = 8;
if( LoggerContext->ClockType != 4 )
ClockType = LoggerContext->ClockType;
*((_DWORD *)Buffer + 94) = ClockType;
*((_QWORD *)Buffer + 20) = HIDWORD(v36);
*((_QWORD *)Buffer + 21) = v37;
Length = LoggerContext->LoggerName.Length;
v34 = (char *)Buffer + 384;
v16 = (char *)Buffer + Length + 384;
v17 = 104i64;
}
else
{
*((_DWORD *)Buffer + 18) = -1073676286;
*((_LARGE_INTEGER *)Buffer + 44) = v14;
*((_DWORD *)Buffer + 37) = 4;
*((_QWORD *)Buffer + 45) = LoggerContext->ReferenceTime.StartTime.QuadPart;
*((_QWORD *)Buffer + 43) = *(&ExBootDevicesRemovedEvent + 244);
if( LoggerContext->ClockType != 4 )
ClockType = LoggerContext->ClockType;
*((_DWORD *)Buffer + 92) = ClockType;
*((_DWORD *)Buffer + 40) = HIDWORD(v36);
*((_DWORD *)Buffer + 41) = v37;
v30 = LoggerContext->LoggerName.Length;
v34 = (char *)Buffer + 376;
v16 = (char *)Buffer + v30 + 376;
v17 = 96i64;
}
v18 = (char *)Buffer + v17;
RtlpQueryTimeZoneInformationWorker((char *)Buffer + v17 + 72, 0xACu);
v19 = *(_QWORD *)(v18 + 140);
v20 = _mm_srli_si128(*(__m128i *)(v18 + 140), 8).m128i_u64[0];
*((_WORD *)v18 + 70) = v19;
*((_WORD *)v18 + 75) = v20;
*((_WORD *)v18 + 71) = WORD1(v19);
*((_WORD *)v18 + 73) = WORD2(v19);
*((_WORD *)v18 + 72) = HIWORD(v20);
*((_WORD *)v18 + 76) = WORD1(v20);
*((_WORD *)v18 + 74) = HIWORD(v19);
*((_WORD *)v18 + 77) = WORD2(v20);
v21 = *((__m128i *)v18 + 14);
v22 = *((_QWORD *)v18 + 28);
*((_DWORD *)v18 + 56) = v22;
*((_WORD *)v18 + 115) = WORD2(v22);
*((_WORD *)v18 + 116) = HIWORD(v22);
v35 = v21;
v21.m128i_i64[0] = _mm_srli_si128(v21, 8).m128i_u64[0];
*((_WORD *)v18 + 117) = v21.m128i_i16[0];
*((_WORD *)v18 + 114) = v21.m128i_i16[3];
*((_WORD *)v18 + 119) = v21.m128i_i16[2];
v23 = v34;
*((_WORD *)v18 + 118) = v21.m128i_i16[1];
memmove(v23, LoggerContext->LoggerName.Buffer, LoggerContext->LoggerName.Length + 2);
memmove(v16 + 2, LoggerContext->LogFileName.Buffer, LoggerContext->LogFileName.Length + 2);
*((_DWORD *)Buffer + 2) += (v6 + 39) & 0xFFFFFFF8;
if( (LoggerContext->LoggerMode & 0x2000000) != 0
&& (unsigned int)(*((_DWORD *)Buffer + 2) + 68) <= *(_DWORD *)Buffer )
{
v26 = (_LARGE_INTEGER *)((char *)Buffer + *((unsigned int *)Buffer + 2));
v26->anonymous_0.HighPart = 327748;
v26->anonymous_0.LowPart = -1073610750;
v26[1].anonymous_0.LowPart = (ULONG)CurrentThread->Cid.UniqueThread;
v26[1].anonymous_0.HighPart = (LONG)CurrentThread->Cid.UniqueProcess;
v26[3].anonymous_0.LowPart = CurrentThread->Tcb.SchedulerApc.SpareLong0;
v26[3].anonymous_0.HighPart = CurrentThread->Tcb.UserTime;
v26[2] = *p_StartPerfClock;
SiloState = LoggerContext->SiloState;
v28 = BYTE2(LoggerContext->$B4A554AA980A5EA7570A49F99BAE17BC::_bf_0);
*(_OWORD *)&v26[4].anonymous_0.LowPart = *(_OWORD *)SiloState->SystemLoggerSettings.EtwpGroupMasks[v28].Masks;
v29 = *(_OWORD *)&SiloState->SystemLoggerSettings.EtwpGroupMasks[v28].Masks[4];
v26[8].anonymous_0.LowPart = 80;
*(_OWORD *)&v26[6].anonymous_0.LowPart = v29;
*((_DWORD *)Buffer + 2) += 72;
}
if( (unsigned int)(*((_DWORD *)Buffer + 2) + 80) <= *(_DWORD *)Buffer )
{
v24 = (_LARGE_INTEGER *)((char *)Buffer + *((unsigned int *)Buffer + 2));
v24->anonymous_0.HighPart = 5242960;
v24->anonymous_0.LowPart = -1073610750;
v24[1].anonymous_0.LowPart = (ULONG)CurrentThread->Cid.UniqueThread;
v24[1].anonymous_0.HighPart = (LONG)CurrentThread->Cid.UniqueProcess;
v24[3].anonymous_0.LowPart = CurrentThread->Tcb.SchedulerApc.SpareLong0;
v24[3].anonymous_0.HighPart = CurrentThread->Tcb.UserTime;
v24[2] = *p_StartPerfClock;
v24[4].anonymous_0.LowPart = 0;
v24[4].anonymous_0.HighPart = LoggerContext->SiloState->PartitionType;
*(_GUID *)&v24[6].anonymous_0.LowPart = LoggerContext->SiloState->PartitionId;
v24[5] = (_LARGE_INTEGER)LoggerContext->ReferenceQpcDelta;
*(_GUID *)&v24[8].anonymous_0.LowPart = LoggerContext->SiloState->ParentId;
*((_DWORD *)Buffer + 2) += 80;
}
v25 = *(_DWORD *)Buffer;
*((_DWORD *)Buffer + 12) = *((_DWORD *)Buffer + 2);
if( *((_DWORD *)Buffer + 2) < (unsigned int)v25 )
{
if( LoggerContext->DebugIdTrackingList.Flink != &LoggerContext->DebugIdTrackingList
|| LoggerContext->DecodeControlCount )
{
LODWORD(Flags) = 3;
EtwpAddDebugInfoEvents(LoggerContext, Buffer, v25, &LoggerContext->ReferenceTime.StartPerfClock, Flags);
}
if( LoggerContext->BinaryTrackingList.Flink != &LoggerContext->BinaryTrackingList )
EtwpAddBinaryInfoEvents(LoggerContext, Buffer, *(_DWORD *)Buffer);
}
*((_DWORD *)Buffer + 1) = *((_DWORD *)Buffer + 12);
*((_DWORD *)Buffer + 11) = 3;
EtwpPrepareHeader(LoggerContext, Buffer, 1ui64);
*((_DWORD *)Buffer + 1) = *((_DWORD *)Buffer + 2);
}
}Referenced by:
EtwpPreserveLogger
EtwpUpdateFileHeader