EtwWriteEx

NTSTATUS __stdcall EtwWriteEx(
        REGHANDLE RegHandle,
        PCEVENT_DESCRIPTOR EventDescriptor,
        ULONG64 Filter,
        ULONG Flags,
        _LPCGUID ActivityId,
        _LPCGUID RelatedActivityId,
        ULONG UserDataCount,
        PEVENT_DATA_DESCRIPTOR UserData){
  char v10; 
  NTSTATUS v12; 
  __int64 v13; 
  unsigned __int8 v14; 
  __int64 v15; 
  __int64 v16; 
  unsigned __int64 Keyword; 
  unsigned __int8 v18; 
  __int64 v19; 
  unsigned __int8 v21; 
  __int64 v22; 
  char v23; 
  unsigned __int8 v24; 
  __int64 v25; 
  PEVENT_DATA_DESCRIPTOR v26; 
  unsigned __int8 v27; 
  __int64 v28; 
  __int64 v29; 
  __int64 v30[2]; 
  __int128 v31; 

  v29 = 0i64;
  v10 = Filter;
  v12 = 0;
  *(_OWORD *)v30 = 0i64;
  v31 = 0i64;
  if( !RegHandle )
    return -1073741816;
  v13 = *(_QWORD *)(RegHandle + 104);
  v14 = *(_BYTE *)(RegHandle + 100);
  v15 = v13 + 28;
  if( !v13 )
    v15 = 0i64;
  if( v14 )
  {
    v16 = *(_QWORD *)(RegHandle + 32);
    Keyword = EventDescriptor->Keyword;
    if( *(_DWORD *)(v16 + 96) )
    {
      v18 = *(_BYTE *)(v16 + 100);
      if( (EventDescriptor->Level <= v18 || !v18)
        && ((*(_DWORD *)(v16 + 104) & 0x40) != 0 && !Keyword
         || (Keyword & *(_QWORD *)(v16 + 112)) != 0 && (Keyword & *(_QWORD *)(v16 + 120)) == *(_QWORD *)(v16 + 120)) )
      {
        v12 = EtwpEventWriteFull(
                v16,
                v14,
                v10,
                Flags,
                (__int64)EventDescriptor,
                0,
                0,
                *(__int64 *)&ActivityId,
                *(__int64 *)&RelatedActivityId,
                UserDataCount,
                (__int64)UserData,
                0i64,
                (__int64)v30,
                0i64,
                *(_WORD *)(RegHandle + 98),
                v15,
                (__int64)&v29);
      }
    }
  }
  if( *(_BYTE *)(RegHandle + 101)
    && EtwpLevelKeywordEnabled(
         (_TRACE_ENABLE_INFO *)(*(_QWORD *)(RegHandle + 40) + 96i64),
         EventDescriptor->Level,
         EventDescriptor->Keyword) )
  {
    v12 = EtwpEventWriteFull(
            *(_QWORD *)(RegHandle + 32),
            v21,
            v10,
            Flags,
            (__int64)EventDescriptor,
            0,
            0,
            *(__int64 *)&ActivityId,
            *(__int64 *)&RelatedActivityId,
            UserDataCount,
            (__int64)UserData,
            0i64,
            (__int64)v30,
            v22,
            *(_WORD *)(RegHandle + 98),
            v15,
            (__int64)&v29);
  }
  v19 = *(_QWORD *)(RegHandle + 32);
  if( *(_QWORD *)(v19 + 400) )
  {
    v23 = *(_BYTE *)(RegHandle + 102);
    *(_OWORD *)v30 = 0i64;
    v31 = 0i64;
    if( v23 )
    {
      v26 = UserData;
      if( EtwpLevelKeywordEnabled(
             (_TRACE_ENABLE_INFO *)(*(_QWORD *)(v19 + 400) + 96i64),
             EventDescriptor->Level,
             EventDescriptor->Keyword) )
      {
        v12 = EtwpEventWriteFull(
                v25,
                v24,
                0,
                Flags,
                (__int64)EventDescriptor,
                0,
                0,
                *(__int64 *)&ActivityId,
                *(__int64 *)&RelatedActivityId,
                UserDataCount,
                (__int64)UserData,
                0i64,
                (__int64)v30,
                0i64,
                *(_WORD *)(RegHandle + 98),
                v15,
                (__int64)&v29);
      }
    }
    else
    {
      v26 = UserData;
    }
    if( *(_BYTE *)(RegHandle + 103) )
    {
      if( EtwpLevelKeywordEnabled(
             (_TRACE_ENABLE_INFO *)(*(_QWORD *)(*(_QWORD *)(RegHandle + 40) + 400i64) + 96i64),
             EventDescriptor->Level,
             EventDescriptor->Keyword) )
      {
        return EtwpEventWriteFull(
                 *(_QWORD *)(*(_QWORD *)(RegHandle + 32) + 400i64),
                 v27,
                 0,
                 Flags,
                 (__int64)EventDescriptor,
                 0,
                 0,
                 *(__int64 *)&ActivityId,
                 *(__int64 *)&RelatedActivityId,
                 UserDataCount,
                 (__int64)v26,
                 0i64,
                 (__int64)v30,
                 v28,
                 *(_WORD *)(RegHandle + 98),
                 v15,
                 (__int64)&v29);
      }
    }
  }
  return v12;
}

Referenced by: