EtwpFileProvTrace

VOID __stdcall EtwpFileProvTrace(EVENT_DATA_DESCRIPTOR *EventData, UINT64 DataCount, UINT16 HookId, GUID *ActivityId){
  unsigned int v4; 
  int v6; 
  __int64 *v8; 
  UINT64 v9; 
  UINT64 UserDataCount; 
  v4 = 0;
  v6 = DataCount;
  switch( HookId )
  {
    case 0x440u:
      v8 = KFileEvt_Create;
      goto LABEL_25;
    case 0x441u:
      v8 = KFileEvt_Cleanup;
      goto LABEL_25;
    case 0x442u:
      v8 = KFileEvt_Close;
      goto LABEL_25;
    case 0x443u:
      v4 = 1;
      v8 = KFileEvt_Read;
      goto LABEL_25;
    case 0x444u:
      v4 = 1;
      v8 = KFileEvt_Write;
      goto LABEL_25;
    case 0x445u:
      v8 = KFileEvt_SetInformation;
      goto LABEL_25;
    case 0x446u:
      v8 = KFileEvt_Delete;
      goto LABEL_25;
    case 0x447u:
      v8 = KFileEvt_Rename;
      goto LABEL_25;
    case 0x448u:
      v8 = KFileEvt_DirEnum;
      goto LABEL_25;
    case 0x449u:
      v8 = KFileEvt_Flush;
      goto LABEL_25;
    case 0x44Au:
      v8 = KFileEvt_QueryInformation;
      goto LABEL_25;
    case 0x44Bu:
      v8 = KFileEvt_FSCTL;
      goto LABEL_25;
    case 0x44Cu:
      v4 = 1;
      v8 = (__int64 *)&KFileEvt_OperationEnd;
      goto LABEL_25;
    case 0x44Du:
      v8 = KFileEvt_DirNotify;
      goto LABEL_25;
    case 0x44Eu:
      v8 = KFileEvt_CreateNewFile;
      goto LABEL_25;
    case 0x44Fu:
      v8 = KFileEvt_DeletePath;
      goto LABEL_25;
    case 0x450u:
      v8 = KFileEvt_RenamePath;
      goto LABEL_25;
    case 0x451u:
      v8 = KFileEvt_SetLinkPath;
      goto LABEL_25;
    case 0x452u:
      v8 = KFileEvt_SetLink;
      goto LABEL_25;
    case 0x453u:
      v8 = KFileEvt_SetSecurity;
      goto LABEL_25;
    case 0x454u:
      v8 = KFileEvt_QuerySecurity;
      goto LABEL_25;
    case 0x455u:
      v8 = KFileEvt_SetEA;
      goto LABEL_25;
    case 0x456u:
      v8 = KFileEvt_QueryEA;
LABEL_25:
      v9 = EtwpFileProvRegHandle;
      if( EtwEventEnabled(EtwpFileProvRegHandle, (EVENT_DESCRIPTOR *)v8, (EVENT_DESCRIPTOR *)HookId) )
      {
        LODWORD(UserDataCount) = v6;
        EtwWriteEx(v9, (EVENT_DESCRIPTOR *)v8, 0i64, v4, ActivityId, 0i64, UserDataCount, EventData);
      }
      break;
    default:
      return;
  }
}

Referenced by: