BapdRecordFirmwareBootStats

NTSTATUS __stdcall BapdRecordFirmwareBootStats(
        PFILE_OBJECT pFileObject,
        UINT32 Level,
        PVOID pBuffer,
        PULONG pBufferSize){
  UINT64 v4; 
  _QWORD *PoolWithTag; 
  WCHAR v6; 
  unsigned __int64 v7; 
  UINT64 v8; 
  NTSTATUS result; 
  SIZE_T NumberOfBytes; 
  REGHANDLE RegHandle; 
  unsigned __int64 Data; 
  unsigned __int64 v13; 
  unsigned __int64 v14; 
  unsigned __int64 v15; 
  unsigned __int64 v16; 
  unsigned __int64 v17; 
  unsigned __int64 v18; 
  unsigned __int64 v19; 
  unsigned __int64 v20; 
  struct _UNICODE_STRING DestinationString; 
  EVENT_DATA_DESCRIPTOR UserData; 
  unsigned __int64 *v23; 
  __int64 v24; 
  unsigned __int64 *p_Data; 
  __int64 v26; 
  unsigned __int64 *v27; 
  __int64 v28; 
  unsigned __int64 *v29; 
  __int64 v30; 
  struct _EVENT_DATA_DESCRIPTOR v31; 
  REGHANDLE *p_RegHandle; 
  __int64 v33; 
  unsigned __int64 *v34; 
  __int64 v35; 
  unsigned __int64 *v36; 
  __int64 v37; 
  unsigned __int64 *v38; 
  __int64 v39; 
  unsigned __int64 *v40; 
  __int64 v41; 
  v15 = 0i64;
  v16 = 0i64;
  v14 = 0i64;
  DestinationString = 0i64;
  v13 = 0i64;
  v4 = 0i64;
  RegHandle = 0i64;
  PoolWithTag = 0i64;
  LODWORD(NumberOfBytes) = 0;
  Data = 0i64;
  TraceLoggingRegisterEx_EtwRegister_EtwSetInformation(&dword_140C02E30);
  if( !(unsigned __int8)ExIsSoftBoot() )
  {
    if( BapdRegisterEtwProvider((GUID *)&BOOTENV_ETW_PROVIDER, 1u, &RegHandle) >= 0
      && ((unsigned int(__fastcall *)(__int64, _QWORD, _QWORD, SIZE_T *))off_140C00A68[0])(
           34i64,
           0i64,
           0i64,
           &NumberOfBytes) == -1073741820
      && (_DWORD)NumberOfBytes
      && (PoolWithTag = ExAllocatePoolWithTag(PagedPool, (unsigned int)NumberOfBytes, 0x73627746ui64)) != 0i64
      && ((int(__fastcall *)(__int64, _QWORD, _QWORD *, SIZE_T *))off_140C00A68[0])(
           34i64,
           (unsigned int)NumberOfBytes,
           PoolWithTag,
           &NumberOfBytes) >= 0 )
    {
      v4 = RegHandle;
      v13 = PoolWithTag[2] / 0xF4240ui64;
      v14 = PoolWithTag[3] / 0xF4240ui64;
      Data = PoolWithTag[4] / 0xF4240ui64;
      v15 = PoolWithTag[5] / 0xF4240ui64;
      v7 = PoolWithTag[6];
      *(_QWORD *)&UserData.Size = 8i64;
      UserData.Ptr = (unsigned __int64)&v13;
      v23 = &v14;
      p_Data = &Data;
      v27 = &v15;
      v29 = &v16;
      v16 = v7 / 0xF4240;
      v24 = 8i64;
      v26 = 8i64;
      v28 = 8i64;
      v30 = 8i64;
      EtwWrite(RegHandle, (EVENT_DESCRIPTOR *)&BOOT_FW_BOOT_PERF_DATA, 0i64, 5ui64, &UserData);
      if( (unsigned int)dword_140C02E30 > 4 && tlgKeywordOn((__int64)&dword_140C02E30, 0x400000000000i64) )
      {
        RegHandle = v13;
        v33 = 8i64;
        p_RegHandle = &RegHandle;
        v17 = v14;
        v34 = &v17;
        v18 = Data;
        v36 = &v18;
        v19 = v15;
        v38 = &v19;
        v20 = v16;
        v40 = &v20;
        v35 = 8i64;
        v37 = 8i64;
        v39 = 8i64;
        v41 = 8i64;
        tlgWriteTransfer_EtwWriteTransfer(
          (__int64)&dword_140C02E30,
          (unsigned __int8 *)word_14002CAAA,
          0i64,
          0i64,
          7u,
          &v31);
      }
    }
    else
    {
      v4 = RegHandle;
    }
  }
  RtlInitUnicodeString(&DestinationString, L"FwPOSTTime", v6);
  BapdpWriteEventDataToRegistry(&Data, v8, &DestinationString);
  if( PoolWithTag )
    ExFreePoolWithTag(PoolWithTag, NumberOfBytes);
  if( v4 )
    return EtwUnregister(v4);
  return result;
}

Referenced by: