EtwpTraceOpticalIo
VOID __stdcall EtwpTraceOpticalIo(UINT64 Key, UINT64 DiskNumber, _IRP *Irp, _LARGE_INTEGER ResponseTime){
_IO_STACK_LOCATION *CurrentStackLocation;
int v7;
unsigned __int8 MajorFunction;
_ETHREAD *v9;
int v10;
UINT16 v11;
int *v12;
_CDB *ScsiPassThroughCdb;
char v14;
unsigned __int64 v15;
__int16 v16;
unsigned int v17;
_ETHREAD *v18;
int v19;
int v20;
UINT16 v21;
unsigned int Flags;
__int64 v23;
_ETHREAD *Thread;
int UniqueThread;
int v26;
union {_IRP *MasterIrp;int IrpCount;void *SystemBuffer;} v27;
_FILE_OBJECT *OriginalFileObject;
int CurrentLocation;
int StackCount;
_FILE_OBJECT **p_FileObject;
int v32;
unsigned int v33;
int Information;
int v35;
unsigned __int64 v36;
void *FsContext;
_IRP *v38;
_LARGE_INTEGER v39;
int v40;
int v41;
int v42[2];
_LARGE_INTEGER v43;
_IRP *v44;
int v45;
int v46;
int *v47;
int v48;
int v49;
v46 = 0;
v41 = 0;
CurrentStackLocation = Irp->Tail.CurrentStackLocation;
v7 = DiskNumber;
MajorFunction = CurrentStackLocation->MajorFunction;
if( (unsigned __int8)(CurrentStackLocation->MajorFunction - 3) <= 1u )
{
Information = Irp->IoStatus.Information;
v32 = DiskNumber;
v38 = Irp;
v21 = (MajorFunction != 3) + 311;
Flags = Irp->Flags;
v33 = Flags;
v23 = *(_QWORD *)&CurrentStackLocation->Parameters.FileAttributes;
v35 = 0;
v36 = v23;
Thread = Irp->Tail.Thread;
v39 = ResponseTime;
if( Thread )
UniqueThread = (int)Thread->Cid.UniqueThread;
else
UniqueThread = -1;
v40 = UniqueThread;
if( (Key & 0xFFFF0000) == 1448280064 )
{
v35 = 1;
}
else
{
v26 = Key & 0xFFFFFF;
if( v26 == 5467492 || v26 == 5460546 )
v35 = 2;
}
if( (Flags & 8) != 0 )
{
v27.MasterIrp = (_IRP *)Irp->AssociatedIrp;
if( v27.MasterIrp )
{
OriginalFileObject = v27.MasterIrp->Tail.OriginalFileObject;
if( OriginalFileObject )
goto LABEL_37;
OriginalFileObject = v27.MasterIrp->Tail.CurrentStackLocation->FileObject;
LABEL_36:
if( OriginalFileObject )
goto LABEL_37;
}
}
else
{
OriginalFileObject = Irp->Tail.OriginalFileObject;
if( OriginalFileObject )
{
LABEL_37:
FsContext = OriginalFileObject->FsContext;
LABEL_39:
v48 = 52;
v11 = v21;
goto LABEL_40;
}
CurrentLocation = (unsigned __int8)Irp->CurrentLocation;
StackCount = Irp->StackCount;
if( CurrentLocation <= StackCount )
{
p_FileObject = &CurrentStackLocation->FileObject;
while( 1 )
{
OriginalFileObject = *p_FileObject;
if( *p_FileObject )
goto LABEL_37;
LOBYTE(CurrentLocation) = CurrentLocation + 1;
p_FileObject += 9;
if( (unsigned __int8)CurrentLocation > StackCount )
goto LABEL_36;
}
}
}
FsContext = 0i64;
goto LABEL_39;
}
if( MajorFunction == 9 )
{
LABEL_3:
v42[1] = Irp->Flags;
v9 = Irp->Tail.Thread;
v42[0] = v7;
v43 = ResponseTime;
v44 = Irp;
if( v9 )
v10 = (int)v9->Cid.UniqueThread;
else
v10 = -1;
v45 = v10;
v11 = 313;
v12 = v42;
v48 = 28;
goto LABEL_41;
}
if( MajorFunction == 14 )
{
ScsiPassThroughCdb = EtwpGetScsiPassThroughCdb(Irp);
if( ScsiPassThroughCdb )
{
v14 = *(_BYTE *)ScsiPassThroughCdb;
v15 = (*((unsigned __int8 *)ScsiPassThroughCdb + 5) | (unsigned __int64)((*((unsigned __int8 *)ScsiPassThroughCdb
+ 4) | ((*((unsigned __int8 *)ScsiPassThroughCdb
+ 3) | (*((unsigned __int8 *)ScsiPassThroughCdb
+ 2) << 8)) << 8)) << 8)) << 11;
if( ((v14 - 40) & 0x7F) != 0 )
{
if( ((v14 - 42) & 0x7F) != 0 )
{
if( v14 != 53 )
return;
goto LABEL_3;
}
v16 = 312;
}
else
{
v16 = 311;
}
v17 = Irp->Flags;
v35 = 0;
FsContext = 0i64;
v36 = v15;
v18 = Irp->Tail.Thread;
v33 = v17;
v19 = Irp->IoStatus.Information;
v32 = v7;
v38 = Irp;
Information = v19;
v39 = ResponseTime;
if( v18 )
v20 = (int)v18->Cid.UniqueThread;
else
v20 = -1;
v40 = v20;
v11 = v16;
v48 = 28;
LABEL_40:
v12 = &v32;
LABEL_41:
v49 = 0;
v47 = v12;
EtwTraceKernelEvent((__int64)&v47, 1u, 0x80000001, v11, 0x401803u);
}
}
}Referenced by:
No references.