EtwpTraceKernelEventWithFilter
VOID __stdcall EtwpTraceKernelEventWithFilter(
EVENT_DATA_DESCRIPTOR *EventData,
UINT64 DataCount,
UINT64 Filter,
UINT16 HookId,
UINT64 Flag){
UINT16 v6;
unsigned int v8;
bool i;
UINT64 v10;
UINT64 v11;
v6 = DataCount;
v8 = Filter & *(_DWORD *)(EtwpHostSiloState + 4224);
for( i = !_BitScanForward((unsigned int *)&Filter, v8); !i; i = !_BitScanForward((unsigned int *)&Filter, v8) )
{
LODWORD(v11) = Flag;
LOWORD(v10) = HookId;
v8 &= v8 - 1;
EtwpLogKernelEvent(
EventData,
EtwpHostSiloState,
*(unsigned __int8 *)(EtwpHostSiloState + 2 * Filter + 4208),
v6,
v10,
v11);
}
}Referenced by:
EtwTraceDuplicateHandle
EtwTraceObject
EtwTraceObjectOperation
EtwpTraceHandle