NtTraceControl
INT64 __fastcall NtTraceControl(
UINT64 FunctionCode,
VOID *InBuffer,
UINT64 InBufferLen,
VOID *OutBuffer,
UINT64 OutBufferLen,
UINT64 *ReturnLength){
unsigned int v7;
UINT8 *v8;
unsigned int *v9;
char v10;
__int64 CurrentSiloState;
unsigned int v12;
int v13;
__int64 v14;
int v15;
unsigned int v16;
unsigned int v17;
UINT64 v18;
unsigned int *PoolWithQuotaTag;
__int64 v20;
UINT8 *v22;
unsigned __int64 v23;
__int64 v24;
__int64 v25;
UINT64 v26;
__int64 v27;
UINT64 *v28;
__int64 v29;
__int16 a3[2];
unsigned int v32;
UINT64 Size;
int v34;
void *Src;
PVOID v36;
__int64 v37;
unsigned int NumberOfBytes;
NumberOfBytes = InBufferLen;
v7 = FunctionCode;
v32 = FunctionCode;
v8 = 0i64;
v9 = 0i64;
Src = 0i64;
LODWORD(Size) = 0;
v10 = *((_BYTE *)KeGetCurrentThread() + 562);
CurrentSiloState = EtwpGetCurrentSiloState();
LOBYTE(v12) = 0;
if( v10 )
{
v12 = v7 >> 31;
v13 = v7 & 0x7FFFFFFF;
if( (v7 & 0x80000000) == 0 )
v13 = v7;
v7 = v13;
v32 = v13;
v14 = 0x7FFFFFFF0000i64;
if( InBuffer )
{
if( NumberOfBytes
&& ((unsigned __int64)InBuffer + NumberOfBytes > 0x7FFFFFFF0000i64 || (char *)InBuffer + NumberOfBytes < InBuffer) )
{
MEMORY[0x7FFFFFFF0000] = 0;
}
}
else
{
NumberOfBytes = 0;
}
if( OutBuffer )
ProbeForWrite(OutBuffer, (unsigned int)OutBufferLen, 1ui64);
else
LODWORD(OutBufferLen) = 0;
if( !ReturnLength )
{
LODWORD(v8) = -1073741811;
v34 = -1073741811;
goto LABEL_149;
}
if( (unsigned __int64)ReturnLength < 0x7FFFFFFF0000i64 )
v14 = (__int64)ReturnLength;
*(_DWORD *)v14 = *(_DWORD *)v14;
}
if( v7 <= 0x1B && (v15 = 134238208, _bittest(&v15, v7)) )
{
v16 = OutBufferLen;
v17 = NumberOfBytes;
}
else
{
v17 = NumberOfBytes;
v16 = OutBufferLen;
if( NumberOfBytes || (_DWORD)OutBufferLen )
{
v18 = (unsigned int)OutBufferLen;
if( NumberOfBytes > (unsigned int)OutBufferLen )
v18 = NumberOfBytes;
PoolWithQuotaTag = (unsigned int *)ExAllocatePoolWithQuotaTag((POOL_TYPE)9, v18, 0x50777445ui64);
v9 = PoolWithQuotaTag;
Src = PoolWithQuotaTag;
if( !PoolWithQuotaTag )
{
LODWORD(v8) = -1073741801;
goto LABEL_149;
}
memset((INT64)PoolWithQuotaTag, 0i64);
if( InBuffer )
memmove((UINT8 *)v9, (UINT8 *)InBuffer, NumberOfBytes);
}
}
switch( v32 )
{
case 1u:
case 2u:
case 3u:
case 4u:
case 5u:
case 6u:
case 7u:
LODWORD(v8) = EtwpValidateUserModeLoggerInfo(v9, v17, v16);
if( (int)v8 >= 0 )
{
if( (unsigned int)v20 <= 6 )
__asm { jmp rcx }
LODWORD(Size) = 176;
}
goto LABEL_137;
case 0xBu:
if( v17 != 96 || v16 != 96 )
goto LABEL_61;
LODWORD(v8) = EtwpRealtimeConnect((__int64)v9);
LODWORD(Size) = 96;
goto LABEL_137;
case 0xCu:
if( v16 != 16 )
goto LABEL_61;
EtwpCreateActivityId((GUID *)OutBuffer);
v23 = v32;
goto LABEL_138;
case 0xDu:
if( v17 != 48 || v16 )
goto LABEL_61;
LODWORD(v8) = WdiDispatchControl((UINT64 *)v9);
goto LABEL_137;
case 0xEu:
if( v17 != 8 || v16 )
goto LABEL_61;
v36 = (PVOID)PtrToUlong((PVOID)*(unsigned int *)InBuffer);
LODWORD(v8) = EtwpRealtimeDisconnectConsumerByHandle(v36);
goto LABEL_137;
case 0xFu:
if( v17 != 160 || v16 - 160 > 0xFF60 )
goto LABEL_61;
LODWORD(v8) = EtwpRegisterUMGuid(
(STRSAFE_LPWSTR)CurrentSiloState,
(SIZE_T)v9,
(SIZE_T *)v16,
(STRSAFE_PCNZWCH)(unsigned __int8)v12,
(SIZE_T)&Size);
goto LABEL_137;
case 0x10u:
if( v17 || v16 - 72 > 0xFFB8 )
goto LABEL_61;
LODWORD(v8) = EtwpReceiveNotification(v9, v16, v12, &Size);
goto LABEL_137;
case 0x11u:
if( v17 < 0x48 || v16 != 72 || v9[1] != v17 )
goto LABEL_61;
if( *v9 == 3 )
{
if( v17 < 0x78 )
goto LABEL_61;
LODWORD(v8) = EtwpEnableGuid(CurrentSiloState, (__int64)v9, 1);
LODWORD(Size) = 72;
}
else
{
LODWORD(v8) = EtwpNotifyGuid(CurrentSiloState, (INT64)v9, 1);
LODWORD(Size) = 72;
}
goto LABEL_137;
case 0x12u:
if( v17 < 0x48 || v9[1] != v17 )
goto LABEL_61;
v9[9] = (unsigned int)PsGetCurrentThreadProcessId();
LODWORD(v8) = EtwpSendReplyDataBlock((_ETWP_NOTIFICATION_HEADER *)v9);
goto LABEL_137;
case 0x13u:
if( v17 != 8 )
goto LABEL_61;
HIDWORD(Size) = 0;
LODWORD(v8) = EtwpReceiveReplyDataBlock(v9, v16, (UINT64 *)((char *)&Size + 4));
LODWORD(Size) = HIDWORD(Size);
goto LABEL_137;
case 0x14u:
if( v17 || v16 )
goto LABEL_61;
LODWORD(v8) = WdiUpdateSem();
goto LABEL_137;
case 0x15u:
LODWORD(Size) = v16;
LODWORD(v8) = EtwpGetTraceGuidList(CurrentSiloState, v9, &Size);
goto LABEL_137;
case 0x16u:
if( v17 != 16 )
goto LABEL_61;
LODWORD(Size) = v16;
LODWORD(v8) = EtwpGetTraceGuidInfo(CurrentSiloState, (INT64)v9);
goto LABEL_137;
case 0x17u:
LODWORD(Size) = v16;
LODWORD(v8) = EtwpEnumerateTraceGuids((_ETW_SILODRIVERSTATE *)CurrentSiloState, v9, &Size);
goto LABEL_137;
case 0x18u:
if( v17 || v16 )
goto LABEL_61;
LODWORD(v8) = EtwpRegisterSecurityProvider(CurrentSiloState);
goto LABEL_137;
case 0x19u:
if( v17 != 4 || v16 != 16 )
goto LABEL_61;
LODWORD(v8) = EtwpQueryReferenceTime((UINT8 *)CurrentSiloState, *v9, v9);
LODWORD(Size) = 16;
goto LABEL_137;
case 0x1Au:
if( v17 != 8 )
goto LABEL_61;
LODWORD(v8) = EtwpTrackProviderBinary(CurrentSiloState, (void **)v9);
goto LABEL_137;
case 0x1Bu:
if( v17 != 4 )
goto LABEL_61;
v24 = *(unsigned int *)InBuffer;
v37 = v24;
if( !v24 )
goto LABEL_61;
LODWORD(v8) = EtwpAddNotificationEvent((PVOID)v24, v12);
goto LABEL_137;
case 0x1Cu:
if( v17 < 8 || 16i64 * v9[1] + 8 != v17 )
goto LABEL_61;
LODWORD(v8) = EtwpUpdateDisallowList((PVOID)CurrentSiloState, *v9);
goto LABEL_137;
case 0x1Eu:
if( v17 != 24 || v16 - 120 > 0xFF88 )
goto LABEL_61;
LODWORD(v8) = EtwpSetProviderTraitsUm((__int64)v9, v16, (unsigned int *)&Size);
goto LABEL_137;
case 0x1Fu:
if( v17 != 16 || v16 )
goto LABEL_61;
LODWORD(v8) = EtwpUseDescriptorTypeUm((INT64)v9);
goto LABEL_137;
case 0x20u:
LODWORD(Size) = v16;
LODWORD(v8) = EtwpGetTraceGroupList(CurrentSiloState, v9, &Size);
goto LABEL_137;
case 0x21u:
if( v17 != 16 )
goto LABEL_61;
LODWORD(Size) = v16;
LODWORD(v8) = EtwpGetTraceGroupInfo((_ETW_SILODRIVERSTATE *)CurrentSiloState, (_GUID *)v9, v9, &Size);
goto LABEL_137;
case 0x22u:
if( v17 != 8 )
goto LABEL_61;
LODWORD(Size) = v16;
LODWORD(v8) = EtwpGetDisallowList((_ETW_SILODRIVERSTATE *)CurrentSiloState, (UINT64 *)v9, v9, &Size);
goto LABEL_137;
case 0x23u:
if( v17 != 16 || v16 )
goto LABEL_61;
LODWORD(v8) = EtwpSetCompressionSettings((UINT64 *)v9);
goto LABEL_137;
case 0x24u:
if( v17 != 8 || v16 != 16 )
goto LABEL_61;
LODWORD(Size) = 16;
LODWORD(v8) = EtwpGetCompressionSettings((UINT16 *)v9, (UINT64 *)v9);
goto LABEL_137;
case 0x25u:
if( v17 < 0xC )
goto LABEL_61;
v25 = *((unsigned __int16 *)v9 + 4);
if( (unsigned int)v25 > 0x10 )
{
LODWORD(v8) = -1073741811;
goto LABEL_137;
}
v26 = v9[1];
if( (unsigned int)(v26 - 1) <= 3 )
{
LODWORD(v8) = -1073741811;
goto LABEL_137;
}
if( (_WORD)v25 )
{
if( !(_DWORD)v26 )
{
LODWORD(v8) = -1073741811;
goto LABEL_137;
}
}
else if( (_DWORD)v26 )
{
LABEL_61:
LODWORD(v8) = -1073741811;
goto LABEL_137;
}
if( 16 * v25 + 12 != v17 )
goto LABEL_61;
if( (_WORD)v25 )
v8 = (UINT8 *)(v9 + 3);
LODWORD(v8) = EtwpUpdatePeriodicCaptureState(*v9, v26, v25, v8);
LABEL_137:
v22 = (UINT8 *)OutBuffer;
v23 = v32;
LABEL_138:
if( (int)v8 < 0 )
{
v28 = ReturnLength;
}
else
{
if( (_DWORD)Size )
memmove(v22, (UINT8 *)v9, (unsigned int)Size);
v28 = ReturnLength;
*(_DWORD *)ReturnLength = Size;
}
if( (_DWORD)v8 == -1073741789 && ((unsigned int)(v23 - 15) <= 1 || (unsigned int)(v23 - 21) <= 1)
|| (unsigned int)v23 <= 0x28 && (v29 = 0x1D700880000i64, _bittest64(&v29, v23)) )
{
*(_DWORD *)v28 = Size;
}
LABEL_149:
if( v9 )
ExFreePoolWithTag(v9, 0);
return(unsigned int)v8;
case 0x26u:
if( v17 < 8 || (v17 & 7) != 0 || v16 < 2 )
goto LABEL_61;
a3[0] = 0;
LODWORD(v8) = EtwpGetPrivateSessionTraceHandle(v9, v17 >> 3, (UINT16 *)a3);
if( !(_DWORD)v8 )
{
LODWORD(Size) = 2;
*(_WORD *)v9 = a3[0];
}
goto LABEL_137;
case 0x27u:
if( v17 < 2 || v16 < 8 )
goto LABEL_61;
v27 = EtwpGetCurrentSiloState();
LODWORD(v8) = EtwpRegisterPrivateSession(v27, *(_WORD *)v9, (_WORD *)v9 + 2, v9);
if( !(_DWORD)v8 )
LODWORD(Size) = 8;
goto LABEL_137;
case 0x28u:
if( v17 < 8 || v16 < 2 )
goto LABEL_61;
LODWORD(v8) = EtwpQuerySessionDemuxObject(*(VOID **)v9, (UINT16 *)v9);
if( !(_DWORD)v8 )
LODWORD(Size) = 2;
goto LABEL_137;
case 0x29u:
if( v17 < 8 )
goto LABEL_61;
LODWORD(v8) = EtwpSetProviderBinaryTracking(CurrentSiloState, *v9, *((_BYTE *)v9 + 4));
goto LABEL_137;
case 0x2Au:
v23 = v32;
v22 = (UINT8 *)OutBuffer;
if( v16 < 4 )
goto LABEL_133;
*v9 = *(_DWORD *)(CurrentSiloState + 16);
LODWORD(Size) = 4;
goto LABEL_138;
case 0x2Bu:
v23 = v32;
v22 = (UINT8 *)OutBuffer;
if( v16 < 4 )
{
LABEL_133:
LODWORD(v8) = -1073741811;
}
else
{
*v9 = EtwpMaxPmcCounter;
LODWORD(Size) = 4;
}
goto LABEL_138;
default:
LODWORD(v8) = -1073741808;
goto LABEL_137;
}
}Referenced by:
PerfDiagpProxyWorker
PerfDiagpSaveActiveDCLLogFileName
PerfDiagpUpdatePerfDiagLoggerEnableFlags