EtwpEventWriteFull
INT64 __fastcall EtwpEventWriteFull(
_ETW_GUID_ENTRY *GuidEntry,
UINT8 RegEntryEnableMask,
UINT64 Filter,
UINT64 Flags,
const _EVENT_DESCRIPTOR *EventDescriptor,
UINT16 EventFlags,
UINT16 EventProperty,
const _GUID *ActivityId,
const _GUID *RelatedActivityId,
UINT64 UserDataCount,
_EVENT_DATA_DESCRIPTOR *UserData,
_ETHREAD *Thread,
UINT64 *LoggerMask,
_ETW_GUID_ENTRY *GroupEntry,
UINT8 UseDescriptorType,
VOID *Traits,
UINT64 *EventKey){
char v17;
_ETW_GUID_ENTRY *v19;
_BYTE *v20;
unsigned __int16 v22;
_ETW_SILODRIVERSTATE *SiloState;
_ETHREAD *CurrentThread;
_ETHREAD *v25;
char v26;
__int64 v27;
_ETW_GUID_ENTRY *v28;
EVENT_DESCRIPTOR *v29;
__int64 v30;
bool v31;
__int64 v32;
INT64 v33;
unsigned int v34;
unsigned __int16 *v35;
char v36;
__int64 v37;
INT64 v38;
int v39;
bool v40;
__int64 v41;
_ETW_FILTER_HEADER *FilterData;
int FilterFlags;
INT16 Id;
__int64 v46;
_ETW_FILTER_HEADER *v47;
unsigned __int8 v48;
UINT64 Keyword;
unsigned __int8 v50;
__int64 v51;
BOOLEAN v52;
__int64 v53;
int v54;
INT64 *v55;
__int64 v56;
int v57;
int v58;
unsigned int v59;
int v60;
int v61;
int v62;
_DWORD *v63;
struct _KPRCB *CurrentPrcb;
__int64 v65;
__int64 v66;
int v67;
int v68;
_ETW_FILTER_HEADER *v69;
int v70;
bool v71;
EVENT_DESCRIPTOR *v72;
unsigned __int8 v73;
unsigned int v74;
char v75;
bool v76;
_ETW_GUID_ENTRY *v77;
UINT64 v78;
unsigned __int8 v79;
unsigned int v80;
void *v81;
INT64 *v82;
bool v83;
char v84;
_OWORD *v85;
unsigned int *p_Size;
__int64 v87;
__int16 v88;
int v89;
char v90;
INT64 v91;
INT64 v92;
unsigned int ReserveTraceBufferStatus;
EVENT_DESCRIPTOR *v94;
int v95;
INT64 v96;
_WORD *v97;
GUID v98;
__int64 v99;
__int64 v100;
UINT8 *v101;
unsigned __int16 *v102;
int SessionId;
int v104;
__int64 v105;
__int64 v106;
struct _KPRCB *v107;
unsigned __int64 v108;
__int64 v109;
_KAPC *PoolWithTag;
unsigned int v111;
unsigned __int16 *v112;
unsigned __int16 v113;
__int64 v114;
unsigned __int16 *v115;
int v116;
__int64 v117;
unsigned __int16 *v118;
__int64 v119;
unsigned int i;
UINT64 Size;
UINT8 *Ptr;
unsigned __int8 v123;
UINT8 *v124;
UINT64 v125;
UINT8 *v126;
INT64 v127;
unsigned __int64 v128;
unsigned __int8 v129;
struct _SLIST_ENTRY *v130;
struct _KPRCB *v131;
__int64 v132;
UNICODE_STRING *BugCheckParameter4;
INT64 Status;
char v135;
INT64 UserMode;
INT64 CurrentIrql;
INT64 Level;
UINT8 v139;
char v140;
UINT8 v141;
UINT8 v142;
unsigned int v143;
int v144;
__int16 v145;
unsigned __int8 v146;
char v147;
int v148;
unsigned int LoggerIndex;
unsigned int LoggerIndex_4;
unsigned __int16 v151;
__int16 v152;
unsigned int v153;
int v154;
_ETW_SILODRIVERSTATE *v155;
EVENT_DESCRIPTOR *EventDescriptora;
_ETW_GUID_ENTRY *GuidEntrya;
unsigned __int16 *v158;
void *Src;
__int64 v160;
INT64 StackLookasideListEntry;
INT64 v162;
unsigned __int16 *v163;
INT64 v164;
_EVENT_DATA_DESCRIPTOR *UserDataa;
_DWORD *v166;
INT64 v167;
UINT8 *dst;
_ETW_SILODRIVERSTATE *v169;
INT64 v170;
INT64 v171;
unsigned __int64 v172;
UINT8 *v173;
UINT64 *v174;
unsigned __int64 HighLimit;
unsigned __int64 LowLimit;
__int64 v177;
UINT64 *v178;
unsigned __int64 v179;
INT64 v180[2];
__int64 v181;
const _GUID *v182;
_OWORD result[24];
unsigned int v184;
CHAR v185;
_ETHREAD *Threada;
v185 = Flags;
v17 = Filter;
v182 = RelatedActivityId;
v19 = GroupEntry;
v164 = (INT64)GuidEntry;
v142 = RegEntryEnableMask;
EventDescriptora = (EVENT_DESCRIPTOR *)EventDescriptor;
UserDataa = UserData;
v174 = LoggerMask;
v173 = (UINT8 *)Traits;
v178 = EventKey;
v154 = 0;
memset((INT64)result, 0i64);
LoggerIndex = 0;
Src = 0i64;
v166 = 0i64;
StackLookasideListEntry = 0i64;
v172 = 0i64;
v152 = UseDescriptorType & 0x200;
v177 = PsGetCurrentServerSiloGlobals()[108];
if( (unsigned int)UserDataCount > 0x80 )
return 3221225485i64;
if( !GroupEntry )
v19 = GuidEntry;
GuidEntrya = v19;
if( v173 )
{
if( (UseDescriptorType & 0x400) != 0 )
v22 = 0;
else
v22 = *(_WORD *)v173;
}
else
{
v22 = 0;
}
v151 = v22;
v140 = 0;
SiloState = GuidEntry->SiloState;
v155 = SiloState;
v169 = SiloState;
if( v178 && *v178 )
{
v172 = *v178;
v140 = 4;
}
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v170 = (INT64)CurrentThread;
v25 = Thread;
if( !Thread )
v25 = CurrentThread;
Threada = v25;
KeAreInterruptsEnabled((CHAR)CurrentThread, v20);
if( v26 )
v141 = KeGetCurrentIrql();
else
v141 = 15;
v146 = v141;
v147 = 0;
if( !v141 )
{
--*(_WORD *)(v170 + 484);
v147 = 1;
}
v142 &= ~v17;
v27 = 80i64;
v28 = v19;
LABEL_21:
v29 = EventDescriptora;
v30 = 1i64;
LABEL_22:
while( 2 )
{
v31 = !_BitScanForward((unsigned int *)&v32, v142);
LoggerIndex = v32;
if( !v31 )
{
LOBYTE(v33) = 1;
v162 = 1i64;
*(_OWORD *)v180 = 0i64;
v181 = 0i64;
v171 = 0i64;
v34 = v27;
v144 = v27;
v35 = 0i64;
v158 = 0i64;
v163 = 0i64;
v36 = 0;
LOBYTE(v145) = 0;
LOWORD(LoggerIndex_4) = 0;
v148 = 0;
dst = 0i64;
v179 = 0i64;
v142 &= v142 - 1;
v37 = (unsigned int)v32;
v160 = (unsigned int)v32;
v38 = (INT64)&v28->EnableInfo[v32];
if( v174 )
{
v39 = *((_DWORD *)v174 + (*(unsigned __int16 *)(v38 + 6) >> 5));
v30 = 1i64;
if( _bittest(&v39, *(_BYTE *)(v38 + 6) & 0x1F) )
continue;
}
v40 = EtwpLevelKeywordEnabled(v38, v29->Level, v29->Keyword);
v30 = 1i64;
if( !v40 )
continue;
v41 = *((_QWORD *)KeGetCurrentThread() + 23);
if( ((v185 & 2) != 0 || *(int *)(v41 + 1120) < 0) && (*(_DWORD *)(v38 + 8) & 0x200) != 0 )
continue;
FilterData = v28->FilterData;
if( FilterData )
{
FilterFlags = FilterData[v37].FilterFlags;
if( (FilterFlags & 0x80000200) == -2147483136 || (FilterFlags & 0x80000100) == -2147483392 )
{
Id = v29->Id;
LODWORD(CurrentIrql) = UserDataCount;
if( !EtwpApplyEventIdPayloadFilter(
(INT64)v28,
LoggerIndex,
0,
(INT64)v29,
Id,
CurrentIrql,
(UINT64)UserDataa,
0,
v141) )
goto LABEL_63;
v29 = EventDescriptora;
}
}
if( v152 )
{
v27 = v29->Keyword;
v46 = 0i64;
v47 = GuidEntrya->FilterData;
if( v47 )
{
v30 = 104 * v37;
if( (v47[v37].FilterFlags & 0x80000400) == -2147482624 )
v46 = *(__int64 *)((char *)&v47->EventNameFilter + v30);
if( v46 )
{
v48 = *(_BYTE *)(v46 + 1);
if( (v29->Level <= v48 || !v48)
&& (!v27 || (v27 & *(_QWORD *)(v46 + 8)) != 0 && (v27 & *(_QWORD *)(v46 + 16)) == *(_QWORD *)(v46 + 16)) )
{
Keyword = v29->Keyword;
v50 = v29->Level;
v139 = 0;
LOBYTE(Level) = v50;
LOBYTE(CurrentIrql) = v141;
LOBYTE(UserMode) = 0;
if( !(unsigned __int8)EtwpApplyEventNameFilter(
GuidEntrya,
LoggerIndex,
(unsigned int)UserDataCount,
UserDataa,
UserMode,
CurrentIrql,
Level,
Keyword) )
goto LABEL_63;
}
}
}
}
v51 = *(unsigned __int16 *)(v38 + 6);
v153 = *(unsigned __int16 *)(v38 + 6);
if( v141 >= 2u )
{
v53 = (__int64)v155;
if( (unsigned int)v51 >= v155->MaxLoggers )
{
LOBYTE(v33) = 1;
v162 = 1i64;
}
else
{
_mm_lfence();
v33 = (INT64)v155->EtwpLoggerContext[v51];
v162 = v33;
}
}
else
{
v52 = ExAcquireRundownProtectionCacheAwareEx(v155->EtwpLoggerRundown[v51], 1u);
v53 = (__int64)v155;
if( v52 )
{
if( (unsigned int)v51 >= v155->MaxLoggers )
{
LOBYTE(v33) = 1;
v162 = 1i64;
}
else
{
_mm_lfence();
v33 = (INT64)v155->EtwpLoggerContext[v51];
v162 = v33;
}
v36 = 1;
LOBYTE(v145) = 1;
}
else
{
v36 = v145;
}
}
if( (v33 & 1) != 0 )
{
if( v36 )
ExReleaseRundownProtectionCacheAwareEx(*(PEX_RUNDOWN_REF_CACHE_AWARE *)(*(_QWORD *)(v53 + 448) + 8 * v51), 1u);
v31 = (_DWORD)v51 == 3;
SiloState = v155;
if( !v31 )
{
LABEL_63:
v28 = GuidEntrya;
v27 = 80i64;
goto LABEL_21;
}
v54 = -1073741058;
if( !v155->EtwpShutdownInProgress )
v54 = -1073741816;
v154 = v54;
break;
}
v57 = v182 != 0i64 ? 8 : 0;
v58 = 104;
if( !v182 )
v58 = 80;
v59 = v58;
v143 = v58;
if( (*(_DWORD *)(v38 + 8) & 0xFFFFFF9F) != 0 )
{
if( EtwpPagingDisabled || (v185 & 1) != 0 || (MmCanThreadFault(), !v60) || *(_BYTE *)(v170 + 1310) )
v61 = 0;
else
v61 = 128;
v57 |= v61;
v62 = *(_DWORD *)(v38 + 8);
v143 = v58;
if( (v62 & 0x800) != 0 )
{
if( v177 != EtwpHostSiloState )
{
v57 |= 0x100u;
v59 = v58 + ((*(unsigned __int16 *)(v177 + 4200) + 15) & 0xFFFFFFF8);
v143 = v59;
}
v35 = v158;
}
if( (v62 & 1) != 0 && (v57 & 0x80u) != 0 )
{
v63 = Src;
if( Src )
goto LABEL_100;
CurrentPrcb = KeGetCurrentPrcb();
v65 = *((_QWORD *)CurrentPrcb + 272);
++*(_DWORD *)(v65 + 20);
v63 = RtlpInterlockedPopEntrySList((PSLIST_HEADER)v65);
Src = v63;
if( !v63 )
{
++*(_DWORD *)(v65 + 24);
v66 = *((_QWORD *)CurrentPrcb + 273);
++*(_DWORD *)(v66 + 20);
v63 = RtlpInterlockedPopEntrySList((PSLIST_HEADER)v66);
Src = v63;
if( !v63 )
{
++*(_DWORD *)(v66 + 24);
v63 = (_DWORD *)(*(__int64(__fastcall **)(_QWORD, _QWORD, _QWORD))(v66 + 48))(
*(unsigned int *)(v66 + 36),
*(unsigned int *)(v66 + 44),
*(unsigned int *)(v66 + 40));
Src = v63;
}
}
if( v63 )
*v63 = *((_DWORD *)CurrentPrcb + 9);
v166 = v63;
if( v63 )
{
EtwpGetSidExtendedHeaderItem((INT64)v63);
v63 = Src;
}
v37 = v160;
if( v63 )
{
LABEL_100:
v57 |= 2u;
v59 += *(unsigned __int16 *)v63;
v143 = v59;
}
}
v67 = *(_DWORD *)(v38 + 8);
if( (v67 & 2) != 0 )
{
v57 |= 1u;
v59 += 16;
v143 = v59;
}
if( (v67 & 0x80u) != 0 && (ObGetCurrentIrql() < 2u || !*((_BYTE *)KeGetCurrentPrcb() + 32)) )
{
v57 |= 0x20u;
v59 += 16;
v143 = v59;
}
v68 = *(_DWORD *)(v38 + 8);
if( (v68 & 0x100) != 0 )
{
v57 |= 0x40u;
v59 += 16;
v143 = v59;
}
if( (v68 & 4) != 0 && !EtwpPagingDisabled )
{
v69 = GuidEntrya->FilterData;
v71 = 0;
if( v69 )
{
v70 = v69[v37].FilterFlags;
if( (v70 & 0x80001000) == -2147479552
|| (v70 & 0x80002000) == -2147475456
|| (v70 & 0x80004000) == -2147467264 )
{
v71 = 1;
}
}
v72 = EventDescriptora;
if( !v71 )
goto LABEL_121;
v73 = v146;
LOBYTE(UserMode) = v146 < 2u;
v74 = LoggerIndex;
EtwpApplyLevelKwFilter((_WMI_LOGGER_CONTEXT *)GuidEntrya);
if( v75 )
{
v76 = v73 < 2u;
v77 = GuidEntrya;
if( EtwpApplyStackWalkIdFilter(v72->Id, (INT64)GuidEntrya, v74, v76) )
{
v78 = v72->Keyword;
v79 = v72->Level;
v139 = 1;
LOBYTE(Level) = v79;
LOBYTE(CurrentIrql) = v141;
LOBYTE(UserMode) = 0;
if( (unsigned __int8)EtwpApplyEventNameFilter(
v77,
v74,
(unsigned int)UserDataCount,
UserDataa,
UserMode,
CurrentIrql,
Level,
v78) )
{
LABEL_121:
if( (v140 & 1) == 0 )
{
v80 = 256;
StackLookasideListEntry = (INT64)EtwpGetStackLookasideListEntry();
if( !StackLookasideListEntry )
{
HighLimit = 0i64;
LowLimit = 0i64;
IoGetStackLimits(&LowLimit, &HighLimit);
if( (unsigned __int64)&HighLimit - LowLimit > 0x1440 )
{
v81 = alloca(1552i64);
StackLookasideListEntry = (INT64)&v135;
v80 = 192;
}
}
if( StackLookasideListEntry )
{
v82 = 0i64;
v83 = (*(_DWORD *)(v162 + 832) & 0x40000000) == 0;
if( *(_QWORD *)(v164 + 40) == *(_QWORD *)&EventTracingProvGuid.Data1
&& *(_QWORD *)(v164 + 48) == *(_QWORD *)EventTracingProvGuid.Data4
&& v72->Id == 18 )
{
v57 |= 0x10u;
v82 = (INT64 *)(v164 + 80);
v83 = 0;
}
EtwpGetStackExtendedHeaderItem(v170, v185, v80, (INT64)&StackLookasideListEntry, v83, v82);
if( StackLookasideListEntry && v80 == 256 )
v84 = 2;
else
v84 = 0;
v140 = v84 | v140 & 0xFD;
}
v140 |= 1u;
}
if( StackLookasideListEntry )
{
v57 |= 4u;
v59 += *(unsigned __int16 *)StackLookasideListEntry;
v143 = v59;
}
}
}
}
}
}
v85 = &result[3 * v184];
v160 = (__int64)v85;
if( (_DWORD)UserDataCount )
{
p_Size = &UserDataa->Size;
v87 = (unsigned int)UserDataCount;
v88 = LoggerIndex_4;
v89 = v148;
do
{
if( v152 )
v90 = *((_BYTE *)p_Size + 4);
else
v90 = 0;
if( v90 )
{
if( v90 == 1 )
{
v88 += *(_WORD *)p_Size;
LOWORD(LoggerIndex_4) = v88;
v148 = ++v89;
}
}
else
{
v59 += *p_Size;
v143 = v59;
}
p_Size += 4;
--v87;
}
while( v87 );
v35 = v158;
v85 = (_OWORD *)v160;
}
if( v148 )
{
v59 += ((unsigned __int16)LoggerIndex_4 + 15) & 0xFFFFFFF8;
v143 = v59;
}
if( v151 )
{
v59 += (v151 + 15) & 0xFFFFFFF8;
v143 = v59;
}
*((_DWORD *)v85 + 10) = v59;
v91 = EtwpReserveTraceBuffer((UINT64 *)v162, v59, (INT64)v180, &v171, 0);
v160 = v91;
if( !v91 )
{
v92 = v162;
ReserveTraceBufferStatus = EtwpGetReserveTraceBufferStatus(v162, v59);
if( EtwEventEnabled(EtwpEventTracingProvRegHandle, (EVENT_DESCRIPTOR *)&ETW_EVENT_LOST_EVENT, v94) )
EtwpTraceLostEvent(
(GUID *)(v164 + 40),
EventDescriptora,
(UNICODE_STRING *)(v92 + 152),
ReserveTraceBufferStatus,
BugCheckParameter4,
Status);
v95 = v154;
if( v154 >= 0 )
{
if( (*(_DWORD *)(v92 + 12) & 0x8000000) == 0 )
v95 = ReserveTraceBufferStatus;
v154 = v95;
}
SiloState = v155;
if( (_BYTE)v145 )
ExReleaseRundownProtectionCacheAwareEx(v155->EtwpLoggerRundown[v153], 1u);
v28 = GuidEntrya;
v27 = 80i64;
if( ReserveTraceBufferStatus == -1073741675 )
{
v154 = -1073741675;
break;
}
goto LABEL_21;
}
v96 = v162;
*(_QWORD *)v85 = v162;
*((_QWORD *)v85 + 1) = v91;
v85[1] = *(_OWORD *)v180;
*((_QWORD *)v85 + 4) = v181;
++v184;
*(_DWORD *)v91 = v59 | *(_DWORD *)(v96 + 20);
v97 = (_WORD *)(v91 + 4);
v167 = v91 + 4;
*(_WORD *)(v91 + 4) = EventFlags;
*(_WORD *)(v91 + 6) = EventProperty;
*(_OWORD *)(v91 + 24) = *(_OWORD *)(v164 + 40);
*(EVENT_DESCRIPTOR *)(v91 + 40) = *EventDescriptora;
if( ActivityId )
v98 = *ActivityId;
else
v98 = NullGuid;
*(GUID *)(v91 + 64) = v98;
*(_QWORD *)(v91 + 16) = v171;
*(_DWORD *)(v91 + 8) = *((_DWORD *)Threada + 288);
*(_DWORD *)(v91 + 12) = *((_DWORD *)Threada + 286);
*(_DWORD *)(v91 + 56) = *((_DWORD *)Threada + 163);
*(_DWORD *)(v91 + 60) = *((_DWORD *)Threada + 183);
if( !v57 )
goto LABEL_207;
if( (v57 & 0x100) != 0 )
{
v158 = (unsigned __int16 *)(v91 + 80);
v99 = v177;
*(_WORD *)(v91 + 80) = (*(_WORD *)(v177 + 4200) + 15) & 0xFFF8;
*(_WORD *)(v91 + 82) = 16;
*(_WORD *)(v91 + 86) = *(_WORD *)(v99 + 4200);
*(_WORD *)(v91 + 84) = 0;
memmove((UINT8 *)(v91 + 88), *(UINT8 **)(v99 + 4192), *(unsigned __int16 *)(v99 + 4200));
memset(v91 + 88 + *(unsigned __int16 *)(v99 + 4200), 0i64);
*v97 |= 1u;
v35 = v158;
v34 = *v158 + 80;
v144 = v34;
v163 = v158;
v91 = v160;
}
if( (v57 & 8) != 0 )
{
v100 = v91 + v34;
*(_DWORD *)v100 = 65560;
*(_DWORD *)(v100 + 4) = 0x100000;
*(_GUID *)(v100 + 8) = *RelatedActivityId;
*v97 |= 1u;
v34 += 24;
v144 = v34;
if( v35 )
v35[2] |= 1u;
v35 = (unsigned __int16 *)v100;
v158 = (unsigned __int16 *)v100;
v163 = (unsigned __int16 *)v100;
}
if( (v57 & 2) != 0 )
{
v101 = (UINT8 *)(v91 + v34);
memmove(v101, (UINT8 *)Src, *(unsigned __int16 *)Src);
*v97 |= 1u;
v34 += *(unsigned __int16 *)Src;
v144 = v34;
if( v35 )
v35[2] |= 1u;
v35 = (unsigned __int16 *)v101;
v158 = (unsigned __int16 *)v101;
v163 = (unsigned __int16 *)v101;
}
if( (v57 & 1) != 0 )
{
v102 = (unsigned __int16 *)(v91 + v34);
*(_DWORD *)v102 = 196624;
*((_DWORD *)v102 + 1) = 0x40000;
SessionId = MmGetSessionIdEx(*((_QWORD *)KeGetCurrentThread() + 23));
v104 = 0;
if( SessionId != -1 )
v104 = SessionId;
*((_DWORD *)v102 + 2) = v104;
*v97 |= 1u;
v34 += 16;
v144 = v34;
if( v35 )
v35[2] |= 1u;
v35 = v102;
v158 = v102;
v163 = v102;
}
if( (v57 & 0x20) != 0 )
{
v105 = v91 + v34;
*(_DWORD *)v105 = 851984;
*(_DWORD *)(v105 + 4) = 0x80000;
*(_QWORD *)(v105 + 8) = *(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2296i64) | ((unsigned __int64)KUSER_SHARED_DATA.BootId << 48);
*v97 |= 1u;
v34 += 16;
v144 = v34;
if( v35 )
v35[2] |= 1u;
v35 = (unsigned __int16 *)v105;
v158 = (unsigned __int16 *)v105;
v163 = (unsigned __int16 *)v105;
}
if( (v57 & 0x40) != 0 )
{
v106 = v91 + v34;
*(_DWORD *)v106 = 655376;
*(_DWORD *)(v106 + 4) = 0x80000;
if( (v140 & 4) != 0 )
{
v108 = v172;
}
else
{
v107 = KeGetCurrentPrcb();
v108 = _InterlockedIncrement64((volatile signed __int64 *)(*((_QWORD *)v107 + 4197) + 8i64)) & 0xFFFFFFFFFFFFi64 | ((unsigned __int64)*((unsigned int *)v107 + 9) << 48);
v172 = v108;
v140 |= 4u;
if( v178 )
*v178 = v108;
}
*(_QWORD *)(v106 + 8) = v108;
*v97 |= 1u;
v34 += 16;
v144 = v34;
if( v35 )
v35[2] |= 1u;
v35 = (unsigned __int16 *)v106;
v158 = (unsigned __int16 *)v106;
v163 = (unsigned __int16 *)v106;
}
if( (v57 & 4) == 0 )
goto LABEL_207;
v109 = v91 + v34;
memmove((UINT8 *)v109, (UINT8 *)StackLookasideListEntry, *(unsigned __int16 *)StackLookasideListEntry);
if( *(_QWORD *)(v109 + 8) && (v57 & 0x10) == 0 )
{
if( v155 != (_ETW_SILODRIVERSTATE *)EtwpHostSiloState )
goto LABEL_203;
PoolWithTag = (_KAPC *)ExAllocatePoolWithTag(NonPagedPoolNx, 0x58ui64, 0x41777445ui64);
if( !PoolWithTag )
goto LABEL_203;
KeInitializeApc(
(INT64)PoolWithTag,
(INT64)Threada,
0i64,
(INT64)EtwpCrimsonStackWalkApc,
0i64,
(INT64)EtwpCrimsonStackWalkApc,
0,
v153);
if( !KeInsertQueueApc(
PoolWithTag,
(PVOID)*(unsigned int *)(v109 + 8),
(PVOID)*(unsigned int *)(v109 + 12),
0i64) )
{
ExFreePoolWithTag(PoolWithTag, 0);
LABEL_203:
*(_QWORD *)(v109 + 8) = 0i64;
}
}
*v97 |= 1u;
v34 += *(unsigned __int16 *)StackLookasideListEntry;
v144 = v34;
if( v35 )
v35[2] |= 1u;
v35 = (unsigned __int16 *)v109;
v158 = (unsigned __int16 *)v109;
v163 = (unsigned __int16 *)v109;
LABEL_207:
v111 = v151;
if( v151 )
{
v112 = (unsigned __int16 *)(v91 + v34);
v171 = (INT64)v112;
v113 = (v151 + 15) & 0xFFF8;
*v112 = v113;
*(_DWORD *)(v112 + 1) = 12;
v112[3] = v111;
v145 = v113 - v111 - 8;
v114 = v111;
memmove((UINT8 *)v112 + 8, v173, v111);
memset((INT64)v112 + v114 + 8, 0i64);
v115 = v158;
*v97 |= 1u;
v34 += *v112;
v144 = v34;
if( v115 )
v115[2] |= 1u;
v35 = v112;
}
v116 = v148;
v117 = v160;
if( v148 )
{
v118 = (unsigned __int16 *)(v160 + v34);
v119 = (unsigned __int16)LoggerIndex_4;
*v118 = (LoggerIndex_4 + 15) & 0xFFF8;
*(_DWORD *)(v118 + 1) = 11;
v118[3] = v119;
dst = (UINT8 *)(v118 + 4);
v179 = (unsigned __int64)v118 + v119 + 8;
memset(v179, 0i64);
*v97 |= 1u;
v34 += *v118;
v144 = v34;
v116 = v148;
if( v35 )
v35[2] |= 1u;
}
for( i = 0; ; ++i )
{
while( 1 )
{
LoggerIndex = i;
if( i >= (unsigned int)UserDataCount )
{
v127 = v162;
if( (*(_DWORD *)(v162 + 12) & 0x80000) != 0
&& (!(_BYTE)KdDebuggerNotPresent && !KdPitchDebugger || KdEventLoggingPresent) )
{
EtwpSendTraceEvent(v162, (INT64)v180);
}
if( *(_QWORD *)(v127 + 1272) )
EtwpInvokeEventCallback(v127, (INT64)v180, v164 + 40);
v29 = EventDescriptora;
SiloState = v155;
v28 = GuidEntrya;
v30 = 1i64;
v27 = 80i64;
if( v174 )
*((_DWORD *)v174 + (v153 >> 5)) |= 1 << (v153 & 0x1F);
goto LABEL_22;
}
Size = UserDataa[i].Size;
LoggerIndex_4 = UserDataa[i].Size;
Ptr = (UINT8 *)UserDataa[i].Ptr;
v123 = v152 ? UserDataa[i].Type : 0;
if( v123 )
break;
v126 = (UINT8 *)(v117 + v34);
v167 = (INT64)v126;
v34 += Size;
v144 = v34;
if( v34 > v59 )
KeBugCheckEx(0x11Du, 5ui64, v34, v59, 0i64);
memmove(v126, Ptr, Size);
v116 = v148;
LABEL_230:
++i;
}
if( v123 != 1 )
{
if( v123 == 3 && (_DWORD)Size == 8 )
*(_QWORD *)(v117 + 16) = *(_QWORD *)Ptr;
goto LABEL_230;
}
v124 = dst;
if( !dst || (v125 = Size, v167 = Size, (unsigned __int64)&dst[Size] > v179) || !v116 )
KeBugCheckEx(0x11Du, 5ui64, v34, v59, 0i64);
memmove(dst, Ptr, Size);
dst = &v124[v125];
v116 = --v148;
}
}
break;
}
if( (v140 & 2) != 0 )
RtlpInterlockedPushEntrySList((PSLIST_HEADER)&EtwpStackLookAsideList, (PSLIST_ENTRY)(StackLookasideListEntry - 16));
if( v154 < 0 )
{
v128 = EventDescriptora->Keyword;
v129 = EventDescriptora->Level;
LODWORD(CurrentIrql) = v154;
EtwpFailLogging(v129, v128, v164, (INT64)result, v142, CurrentIrql, EventDescriptora, v146 < 2u);
}
else if( v184 )
{
v55 = (INT64 *)result;
v56 = v184;
do
{
EtwpReleaseTraceBuffer(v55 + 2);
if( v141 < 2u )
ExReleaseRundownProtectionCacheAwareEx(SiloState->EtwpLoggerRundown[*(unsigned int *)*v55], 1u);
v55 += 6;
--v56;
}
while( v56 );
}
if( v147 )
KeLeaveCriticalRegionThread(v170);
v130 = (struct _SLIST_ENTRY *)Src;
if( Src )
{
v131 = KeGetCurrentPrcb();
v132 = *((_QWORD *)v131 + 272);
++*(_DWORD *)(v132 + 28);
if( *(_WORD *)v132 < *(_WORD *)(v132 + 16)
|| (++*(_DWORD *)(v132 + 32),
v132 = *((_QWORD *)v131 + 273),
++*(_DWORD *)(v132 + 28),
*(_WORD *)v132 < *(_WORD *)(v132 + 16)) )
{
RtlpInterlockedPushEntrySList((PSLIST_HEADER)v132, v130);
}
else
{
++*(_DWORD *)(v132 + 32);
(*(void(__fastcall **)(struct _SLIST_ENTRY *, struct _KPRCB *, __int64, __int64))(v132 + 56))(
v130,
v131,
v30,
v27);
}
}
return(unsigned int)v154;
}Referenced by:
EtwWriteErrorLogEntry
EtwWriteEx
EtwWriteKMSecurityEvent
EtwWriteString
EtwpCrimsonStackWalkApc
EtwpDiskProvTraceDisk