EtwpSetProviderTraitsUm
__int64 __fastcall EtwpSetProviderTraitsUm(__int64 a1, unsigned int a2, unsigned int *a3){
_RTL_RB_TREE *v6;
void *v7;
int v8;
unsigned __int16 Size;
__int64 v10;
unsigned __int64 v11;
UINT8 *PoolWithTag;
int v13;
INT64 v14;
INT64 v15;
INT64 v16;
INT64 a5;
PADAPTER_OBJECT DmaAdapter;
PADAPTER_OBJECT v20;
v6 = 0i64;
if( !*(_QWORD *)(a1 + 8) || !*(_WORD *)(a1 + 16) )
goto LABEL_15;
v7 = *(void **)a1;
DmaAdapter = 0i64;
v8 = ObReferenceObjectByHandle(v7, 0x800u, EtwpRegistrationObjectType, 1, (PVOID *)&DmaAdapter, 0i64);
v6 = (_RTL_RB_TREE *)DmaAdapter;
v20 = DmaAdapter;
if( v8 < 0 )
goto LABEL_16;
Size = DmaAdapter[6].Size;
if( (Size & 8) == 0 && (Size & 2) != 0 )
{
if( DmaAdapter[6].DmaOperations )
{
v8 = -1073741823;
}
else
{
v10 = *(unsigned __int16 *)(a1 + 16);
if( (_WORD)v10 )
{
v11 = *(_QWORD *)(a1 + 8);
if( v11 + v10 > 0x7FFFFFFF0000i64 || v11 + v10 < v11 )
{
MEMORY[0x7FFFFFFF0000] = 0;
LOWORD(v10) = *(_WORD *)(a1 + 16);
}
}
PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(PagedPool, (unsigned __int16)v10 + 28i64, 0x54777445ui64);
v13 = HIDWORD(PoolWithTag);
if( PoolWithTag )
{
memmove(PoolWithTag + 28, *(UINT8 **)(a1 + 8), *(unsigned __int16 *)(a1 + 16));
HIDWORD(a5) = v13;
v8 = EtwpSetProviderTraitsCommon((_ETW_REG_ENTRY *)a1, (_ETW_PROVIDER_TRAITS *)a2, (_FAST_MUTEX *)a3, v6);
}
else
{
v8 = -1073741670;
}
}
}
else
{
LABEL_15:
v8 = -1073741811;
}
LABEL_16:
if( v6 )
{
if( v8
&& EtwEventEnabled(
EtwpEventTracingProvRegHandle,
(EVENT_DESCRIPTOR *)&ETW_EVENT_SET_TRAITS_FAILED,
(EVENT_DESCRIPTOR *)a3) )
{
LODWORD(a5) = v8;
EtwpEventWriteRegistrationStatus(v15, v14, v16, (INT64)v6, a5);
}
HalPutDmaAdapter((PADAPTER_OBJECT)v6);
}
return(unsigned int)v8;
}Referenced by:
NtTraceControl