EtwpLogKernelEvent

VOID __stdcall EtwpLogKernelEvent(
        EVENT_DATA_DESCRIPTOR *EventData,
        UINT64 LoggerId,
        UINT64 DataCount,
        UINT16 HookId,
        UINT64 Flag,
        UINT64 a6){
  __int64 v6; 
  unsigned int v7; 
  unsigned int v8; 
  EVENT_DATA_DESCRIPTOR *v10; 
  CHAR v11; 
  char v12; 
  __int64 v13; 
  __int64 v14; 
  INT64 v15; 
  unsigned int v16; 
  unsigned int v17; 
  __m128i v18; 
  __m128i v19; 
  unsigned int v20; 
  __int64 v21; 
  __m128i v22; 
  __m128i v23; 
  __int64 v24; 
  __int64 v25; 
  __int64 v26; 
  __m128i v27; 
  __m128i v28; 
  __m128i v29; 
  __m128i v30; 
  unsigned int *p_Size; 
  __int64 v32; 
  int v33; 
  INT64 v34; 
  INT64 v35; 
  UINT8 *v36; 
  __int64 Size; 
  signed __int64 *v38; 
  signed __int64 v39; 
  INT64 v40; 
  signed __int64 v41; 
  int v42; 
  __int16 v43; 
  unsigned int v44; 
  unsigned int v45; 
  _ETHREAD *CurrentThread; 
  INT64 v47; 
  _DWORD *v48; 
  INT64 v49; 
  unsigned int v50; 
  __int64 v51; 
  unsigned int v52; 
  __int64 v53; 
  __int64 v54; 
  INT64 a2; 
  INT64 result; 
  INT64 v57; 
  __int64 v58; 
  INT64 v59[2]; 
  __int64 v60; 
  unsigned int v62; 
  v62 = HookId;
  v6 = (unsigned int)DataCount;
  v7 = 0;
  *(_OWORD *)v59 = 0i64;
  v60 = 0i64;
  v8 = HookId;
  a2 = 0i64;
  v10 = EventData;
  v11 = 0;
  KeAreInterruptsEnabled((CHAR)EventData, (_BYTE *)LoggerId);
  if( v12 && KeGetCurrentIrql() < 2u )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 242);
    v13 = v6;
    if( !ExAcquireRundownProtectionCacheAwareEx(
            *(PEX_RUNDOWN_REF_CACHE_AWARE *)(*(_QWORD *)(LoggerId + 448) + 8 * v6),
            1u) )
    {
      KeLeaveCriticalRegion();
      return;
    }
    v11 = 1;
  }
  else
  {
    v13 = v6;
  }
  v14 = *(_QWORD *)(LoggerId + 456);
  v58 = 8 * v13;
  v15 = *(_QWORD *)(8 * v13 + v14);
  v57 = v15;
  if( (v15 & 1) != 0 )
  {
    EtwpCloseLogger((unsigned int)v6, LoggerId, v11);
    return;
  }
  if( v15 )
  {
    v16 = 0;
    v17 = 0;
    if( v8 )
    {
      if( v8 >= 8 )
      {
        v18 = 0i64;
        v19 = 0i64;
        v20 = 2;
        do
        {
          v21 = v17;
          v17 += 8;
          v22 = _mm_unpacklo_epi32(_mm_cvtsi32_si128(v10[v21].Size), _mm_cvtsi32_si128(v10[v20].Size));
          v23 = _mm_cvtsi32_si128(v10[v20 + 4].Size);
          v24 = v20 + 5;
          v25 = v20 + 3;
          v26 = v20 + 2;
          v27 = _mm_add_epi32(
                  _mm_unpacklo_epi32(
                    v22,
                    _mm_unpacklo_epi32(_mm_cvtsi32_si128(v10[v20 - 1].Size), _mm_cvtsi32_si128(v10[v20 + 1].Size))),
                  v18);
          v20 += 8;
          v18 = v27;
          v28 = _mm_add_epi32(
                  _mm_unpacklo_epi32(
                    _mm_unpacklo_epi32(_mm_cvtsi32_si128(v10[v26].Size), v23),
                    _mm_unpacklo_epi32(_mm_cvtsi32_si128(v10[v25].Size), _mm_cvtsi32_si128(v10[v24].Size))),
                  v19);
          v19 = v28;
        }
        while( v17 < (v8 & 0xFFFFFFF8) );
        v29 = _mm_add_epi32(v28, v18);
        v30 = _mm_add_epi32(v29, _mm_srli_si128(v29, 8));
        v16 = _mm_cvtsi128_si32(_mm_add_epi32(v30, _mm_srli_si128(v30, 4)));
      }
      if( v17 < v8 )
      {
        p_Size = &v10[v17].Size;
        v32 = v8 - v17;
        do
        {
          v16 += *p_Size;
          p_Size += 4;
          --v32;
        }
        while( v32 );
      }
    }
    if( (a6 & 0x100) != 0 )
    {
      if( (a6 & 0x10000000) != 0 )
      {
        v49 = EtwpReserveTraceBuffer((UINT64 *)v15, v16 + 24, (INT64)v59, &a2, a6);
        if( !v49 )
          goto LABEL_33;
        *(_DWORD *)v49 = (unsigned __int8)a6 | 0xC0040000;
        *(_QWORD *)(v49 + 16) = a2;
        *(_WORD *)(v49 + 4) = v16 + 24;
        *(_WORD *)(v49 + 6) = Flag;
        *(_DWORD *)(v49 + 8) = *((_DWORD *)KeGetCurrentThread() + 288);
        *(_DWORD *)(v49 + 12) = *(_DWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1088i64);
        v35 = v49 + 24;
      }
      else
      {
        result = (INT64)KeGetCurrentThread();
        v47 = EtwpReserveTraceBuffer((UINT64 *)v15, v16 + 32, (INT64)v59, &a2, a6);
        if( !v47 )
          goto LABEL_33;
        v48 = (_DWORD *)result;
        *(_DWORD *)v47 = (unsigned __int8)a6 | 0xC0020000;
        *(_QWORD *)(v47 + 16) = a2;
        *(_WORD *)(v47 + 4) = v16 + 32;
        *(_WORD *)(v47 + 6) = Flag;
        *(_DWORD *)(v47 + 8) = v48[288];
        *(_DWORD *)(v47 + 12) = v48[286];
        *(_DWORD *)(v47 + 24) = v48[163];
        *(_DWORD *)(v47 + 28) = v48[183];
        v35 = v47 + 32;
      }
    }
    else
    {
      v33 = *(_DWORD *)(v15 + 832);
      if( (v33 & 0xC00) == 0 )
      {
LABEL_16:
        v34 = EtwpReserveTraceBuffer((UINT64 *)v15, v16 + 16, (INT64)v59, &a2, a6);
        if( !v34 )
          goto LABEL_33;
        *(_QWORD *)(v34 + 8) = a2;
        *(_DWORD *)v34 = (unsigned __int8)a6 | 0xC0110000;
        *(_WORD *)(v34 + 4) = v16 + 16;
        *(_WORD *)(v34 + 6) = Flag;
        v35 = v34 + 16;
        goto LABEL_18;
      }
      if( (v33 & 0x400) != 0 && (_WORD)Flag == 1316 )
      {
        v35 = EtwpReserveWithPebsIndex((UINT64 *)v15, 1316, v16, (INT64)v59, &a2, a6);
      }
      else
      {
        if( (v33 & 0x800) == 0 )
          goto LABEL_16;
        v50 = 0;
        if( !*(_DWORD *)(*(_QWORD *)(v15 + 1000) + 8i64) )
          goto LABEL_16;
        while( 1 )
        {
          v51 = *(_QWORD *)(v15 + 1000);
          if( *(_WORD *)(v51 + 2i64 * v50 + 12) == (_WORD)Flag )
            break;
          if( ++v50 >= *(_DWORD *)(v51 + 8) )
            goto LABEL_16;
        }
        v35 = EtwpReserveWithPmcCounters(v15, Flag, v16, (INT64)v59, &a2, a6);
      }
    }
LABEL_18:
    result = v35;
    if( v35 )
    {
      v36 = (UINT8 *)v35;
      if( v8 )
      {
        while( 1 )
        {
          Size = v10->Size;
          if( (unsigned int)Size > v16 )
            break;
          memmove(v36, (UINT8 *)v10->Ptr, (unsigned int)Size);
          v36 += Size;
          v16 -= Size;
          ++v7;
          ++v10;
          if( v7 >= v62 )
          {
            v15 = v57;
            goto LABEL_23;
          }
        }
        memset(result, 0i64);
        v15 = v57;
        EtwpUpdateEventsLostCount(v57);
      }
LABEL_23:
      if( (*(_DWORD *)(v15 + 12) & 0x80000) != 0
        && (!(_BYTE)KdDebuggerNotPresent && !KdPitchDebugger || KdEventLoggingPresent) )
      {
        EtwpSendTraceEvent(v15, (INT64)v59);
      }
      if( *(_QWORD *)(v15 + 1272) )
        EtwpInvokeEventCallback(v15, (INT64)v59, 0i64);
      v38 = (signed __int64 *)v59[1];
      _m_prefetchw((const void *)v59[1]);
      v39 = *v38;
      v40 = v59[0];
      if( ((unsigned __int64)*v38 ^ v59[0]) >= 0xF )
      {
LABEL_42:
        _InterlockedDecrement((volatile signed __int32 *)(v40 + 12));
      }
      else
      {
        while( 1 )
        {
          v41 = v39;
          v39 = _InterlockedCompareExchange64((volatile signed __int64 *)v59[1], v39 + 1, v39);
          if( v41 == v39 )
            break;
          v40 = v59[0];
          if( ((unsigned __int64)v39 ^ v59[0]) >= 0xF )
            goto LABEL_42;
        }
      }
      v42 = *(_DWORD *)(v15 + 832);
      if( (v42 & 0x80u) != 0 )
      {
        v43 = Flag;
        if( _bittest(*(const signed __int32 **)(v15 + 984), Flag & 0x1FFF) )
        {
          v44 = a6;
          EtwpStackTraceDispatcher(v15, &a2, 0i64, a6);
          v42 = *(_DWORD *)(v15 + 832);
LABEL_31:
          v45 = 0;
          if( (v42 & 0x8000) != 0 )
          {
            v52 = 0;
            if( *(_DWORD *)(*(_QWORD *)(v15 + 1008) + 8i64) )
            {
              while( 1 )
              {
                v53 = *(_QWORD *)(v15 + 1008);
                if( *(_WORD *)(v53 + 2i64 * v52 + 12) == v43 )
                  break;
                if( ++v52 >= *(_DWORD *)(v53 + 8) )
                  goto LABEL_32;
              }
              EtwpTraceLastBranchRecord((UINT64 *)v15, &a2, 0i64, v44);
            }
          }
LABEL_32:
          if( (*(_DWORD *)(v15 + 832) & 0x4000000) != 0 && *(_DWORD *)(*(_QWORD *)(v15 + 1016) + 24i64) )
          {
            while( 1 )
            {
              v54 = *(_QWORD *)(v15 + 1016);
              if( *(_WORD *)(v54 + 2i64 * v45 + 28) == v43 )
                break;
              if( ++v45 >= *(_DWORD *)(v54 + 24) )
                goto LABEL_33;
            }
            EtwpTraceProcessorTrace((VOID **)v15, (UINT64)&a2);
          }
          goto LABEL_33;
        }
      }
      else
      {
        v43 = Flag;
      }
      v44 = a6;
      goto LABEL_31;
    }
LABEL_33:
    if( v11 )
    {
      ExReleaseRundownProtectionCacheAwareEx(*(PEX_RUNDOWN_REF_CACHE_AWARE *)(*(_QWORD *)(LoggerId + 448) + v58), 1u);
      KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
    }
  }
}

Referenced by: