EtwpBugCheckMultiPartCallback

VOID __stdcall EtwpBugCheckMultiPartCallback(
        _KBUGCHECK_CALLBACK_REASON Reason,
        _KBUGCHECK_REASON_CALLBACK_RECORD *Record,
        VOID *ReasonSpecificData,
        UINT64 ReasonSpecificDataLength){
  unsigned __int16 *v4; 
  __int64 v6; 
  __int64 v7; 
  unsigned int v8; 
  __int64 v9; 
  _DWORD *v10; 
  __int64 v11; 
  unsigned int v12; 
  unsigned __int16 v13; 
  __int64 v14; 
  __int64 v15; 
  __int64 v16; 
  bool v17; 
  __int64 v18; 
  __int64 v19; 
  int v20; 

  v4 = (unsigned __int16 *)*((_QWORD *)ReasonSpecificData + 6);
  *((_DWORD *)ReasonSpecificData + 10) = 0;
  *((_OWORD *)ReasonSpecificData + 1) = EtwSecondaryDumpDataGuid;
  if( !v4 )
  {
    v4 = (unsigned __int16 *)((char *)&ExBootDevicesRemovedEvent + 1264);
    *(&ExBootDevicesRemovedEvent + 79) = 0i64;
    *((_QWORD *)ReasonSpecificData + 6) = (char *)&ExBootDevicesRemovedEvent + 1264;
  }
  if( *((_BYTE *)v4 + 2) )
  {
    v7 = *((_QWORD *)v4 + 1);
    v8 = *v4;
    if( v7 )
    {
      v9 = *(_QWORD *)(*(_QWORD *)(EtwpHostSiloState + 456) + 8i64 * *v4);
      v10 = (_DWORD *)*((_QWORD *)v4 + 1);
      if( *(_DWORD *)(v7 + 8) <= *v10 )
        *(_DWORD *)(*((_QWORD *)v4 + 1) + 48i64) = v10[2];
      else
        v10[12] = v10[1];
      *((_DWORD *)ReasonSpecificData + 10) = *(_DWORD *)(*((_QWORD *)v4 + 1) + 48i64);
      if( *((_DWORD *)ReasonSpecificData + 2) )
        *((_QWORD *)ReasonSpecificData + 4) = *((_QWORD *)v4 + 1);
      v18 = *(_QWORD *)(*((_QWORD *)v4 + 1) + 56i64);
      v19 = v18 - 56;
      if( v18 == v9 + 96 )
        v19 = 0i64;
      *((_QWORD *)v4 + 1) = v19;
      v17 = v19 == 0;
LABEL_30:
      if( v17 )
        ++*v4;
    }
    else
    {
      while( v8 < *(_DWORD *)(EtwpHostSiloState + 16) )
      {
        v11 = *(_QWORD *)(*(_QWORD *)(EtwpHostSiloState + 456) + 8i64 * (unsigned __int16)v8);
        if( (v11 & 1) == 0 && *(int *)(v11 + 12) < 0 && (*(_DWORD *)(v11 + 316) & 1) == 0 )
        {
          if( *(_QWORD *)(v11 + 712) )
          {
            _mm_pause();
          }
          else
          {
            v12 = 2 * *(unsigned __int16 *)(v11 + 152) + 48;
            *((_DWORD *)ReasonSpecificData + 10) = v12;
            if( !*((_DWORD *)ReasonSpecificData + 2) )
              goto LABEL_21;
            if( v12 <= *((_DWORD *)ReasonSpecificData + 3) )
            {
              v14 = *(_QWORD *)ReasonSpecificData;
              *(_DWORD *)v14 = 32223201;
              *(_DWORD *)(v14 + 4) = *(_DWORD *)v11;
              *(_DWORD *)(v14 + 16) = *(_DWORD *)(v11 + 4);
              *(_DWORD *)(v14 + 12) = *(_DWORD *)(v11 + 216);
              *(_QWORD *)(v14 + 24) = *(_QWORD *)(v11 + 808);
              *(_DWORD *)(v14 + 8) = *(_DWORD *)(v11 + 12);
              *(_DWORD *)(v14 + 20) = *(unsigned __int16 *)(v11 + 152);
              *(_OWORD *)(v14 + 32) = *(_OWORD *)(v11 + 320);
              memmove((VOID *)(v14 + 48), *(const VOID **)(v11 + 160), 2 * *(unsigned __int16 *)(v11 + 152));
              *((_QWORD *)ReasonSpecificData + 4) = *(_QWORD *)ReasonSpecificData;
              *((_DWORD *)ReasonSpecificData + 10) = v12;
              *((_DWORD *)ReasonSpecificData + 2) = v12;
LABEL_21:
              v15 = *(_QWORD *)(v11 + 96);
              v16 = v15 - 56;
              if( v15 == v11 + 96 )
                v16 = 0i64;
              *((_QWORD *)v4 + 1) = v16;
              v17 = v16 == 0;
              goto LABEL_30;
            }
          }
        }
        v13 = *v4 + 1;
        v8 = v13;
        *v4 = v13;
      }
    }
  }
  else
  {
    *((_DWORD *)ReasonSpecificData + 10) = 32;
    if( *((_DWORD *)ReasonSpecificData + 2) )
    {
      v6 = *(_QWORD *)ReasonSpecificData;
      *(_QWORD *)(v6 + 16) = *(&ExBootDevicesRemovedEvent + 244);
      *(_DWORD *)(v6 + 8) = *(&ExBootDevicesRemovedEvent + 381);
      *(_QWORD *)(v6 + 24) = *(&ExBootDevicesRemovedEvent + 189);
      *(_DWORD *)v6 = KeMaximumIncrement;
      *(_DWORD *)(v6 + 4) = NtBuildNumber;
      *((_QWORD *)ReasonSpecificData + 4) = *(_QWORD *)ReasonSpecificData;
      *((_DWORD *)ReasonSpecificData + 10) = 32;
      *((_DWORD *)ReasonSpecificData + 2) = 32;
    }
    *((_BYTE *)v4 + 2) = 1;
  }
  v20 = *((_DWORD *)ReasonSpecificData + 14);
  if( (unsigned int)*v4 >= *(_DWORD *)(EtwpHostSiloState + 16) )
  {
    *((_DWORD *)ReasonSpecificData + 14) = v20 & 0xFFFFFFFE;
    *((_QWORD *)v4 + 1) = 0i64;
    *((_BYTE *)v4 + 2) = 0;
    *v4 = 0;
  }
  else
  {
    *((_DWORD *)ReasonSpecificData + 14) = v20 | 1;
  }
}

Referenced by: