EtwpLogSystemEventUnsafe

void __fastcall EtwpLogSystemEventUnsafe(
        __int64 a1,
        __int64 a2,
        __int64 a3,
        unsigned int a4,
        unsigned int a5,
        __int16 a6,
        unsigned int a7){
  unsigned int v9; 
  UINT64 *v10; 
  INT64 v11; 
  int v12; 
  _DWORD *v13; 
  __int64 v14; 
  INT64 v15; 
  int v16; 
  struct _RTL_SPLAY_LINKS *v17; 
  int v18; 
  __int64 v19; 
  int v20; 
  __int16 v21; 
  unsigned int v22; 
  __int64 v23; 
  __int64 v24; 
  char a3a[4]; 
  int v26; 
  __int64 a2a; 
  int v28; 
  UINT64 *v29; 
  INT64 v30; 
  UINT64 *v31; 
  INT64 a1a[2]; 
  __int64 v33; 
  *(_OWORD *)a1a = 0i64;
  v33 = 0i64;
  v9 = 0;
  a3a[0] = 0;
  a2a = 0i64;
  v10 = (UINT64 *)EtwpOpenLogger(a4, a1, 1, a3a);
  v29 = v10;
  v11 = (INT64)v10;
  v31 = v10;
  if( v10 )
  {
    v12 = 0;
    v26 = 0;
    if( a5 )
    {
      v13 = (_DWORD *)(a2 + 8);
      v14 = a5;
      do
      {
        v12 += *v13;
        v13 += 4;
        --v14;
      }
      while( v14 );
      v26 = v12;
    }
    v15 = EtwpReserveTraceBuffer(v10, (unsigned int)(v12 + 32), (INT64)a1a, &a2a, a7);
    if( v15 )
    {
      v16 = -1073676288;
      if( (a7 & 0xC0000000) != 0x80000000 )
        v16 = -1073610752;
      *(_DWORD *)v15 = (unsigned __int8)a7 | v16;
      *(_QWORD *)(v15 + 16) = a2a;
      *(_WORD *)(v15 + 4) = v12 + 32;
      *(_WORD *)(v15 + 6) = a6;
      *(_DWORD *)(v15 + 8) = *(_DWORD *)(a3 + 1152);
      *(_DWORD *)(v15 + 12) = *(_DWORD *)(a3 + 1144);
      *(_DWORD *)(v15 + 24) = *(_DWORD *)(a3 + 652);
      *(_DWORD *)(v15 + 28) = *(_DWORD *)(a3 + 732);
      v17 = (struct _RTL_SPLAY_LINKS *)(v15 + 32);
      v30 = v15 + 32;
      if( v15 != -32 )
      {
        EtwpCopyEventData(v17, (PRTL_SPLAY_LINKS *)a2);
        v28 = v18;
        v19 = (__int64)v29;
        if( v18 )
        {
          memset((INT64)v17, 0i64);
          EtwpUpdateEventsLostCount(v11);
        }
        if( (*(_DWORD *)(v11 + 12) & 0x80000) != 0
          && (!(_BYTE)KdDebuggerNotPresent && !KdPitchDebugger || KdEventLoggingPresent) )
        {
          EtwpSendTraceEvent(v11, (INT64)a1a);
        }
        if( *(_QWORD *)(v11 + 1272) )
          EtwpInvokeEventCallback(v11, (INT64)a1a, 0i64);
        EtwpReleaseTraceBuffer(a1a);
        v20 = *(_DWORD *)(v11 + 832);
        if( (v20 & 0x80u) != 0 )
        {
          v21 = a6;
          if( _bittest(*(const signed __int32 **)(v11 + 984), a6 & 0x1FFF) )
          {
            EtwpStackTraceDispatcher(v11, &a2a, a3, a7);
            v20 = *(_DWORD *)(v19 + 832);
          }
        }
        else
        {
          v21 = a6;
        }
        if( (v20 & 0x8000) != 0 )
        {
          v22 = 0;
          if( *(_DWORD *)(*(_QWORD *)(v11 + 1008) + 8i64) )
          {
            while( 1 )
            {
              v23 = *(_QWORD *)(v11 + 1008);
              if( *(_WORD *)(v23 + 2i64 * v22 + 12) == v21 )
                break;
              if( ++v22 >= *(_DWORD *)(v23 + 8) )
                goto LABEL_18;
            }
            EtwpTraceLastBranchRecord((UINT64 *)v11, &a2a, (_ETHREAD *)a3, a7);
          }
        }
LABEL_18:
        if( (*(_DWORD *)(v11 + 832) & 0x4000000) != 0 && *(_DWORD *)(*(_QWORD *)(v11 + 1016) + 24i64) )
        {
          while( 1 )
          {
            v24 = *(_QWORD *)(v11 + 1016);
            if( *(_WORD *)(v24 + 2i64 * v9 + 28) == v21 )
              break;
            if( ++v9 >= *(_DWORD *)(v24 + 24) )
              goto LABEL_19;
          }
          EtwpTraceProcessorTrace((VOID **)v11, (UINT64)&a2a);
        }
      }
    }
LABEL_19:
    EtwpCloseLogger(a4, a1, a3a[0]);
  }
}

Referenced by: