EtwpAddLogHeader
unsigned __int64 __fastcall EtwpAddLogHeader(__int64 a1, __int64 a2){
bool IsWow64Logger;
unsigned __int64 result;
__int64 v6;
unsigned __int16 v7;
_ETHREAD *CurrentThread;
_QWORD *v9;
unsigned int UsedProcessorCount;
char v11;
char v12;
bool v13;
int v14;
union _LARGE_INTEGER v15;
__int64 v16;
__int64 v17;
__int64 v18;
__int64 v19;
__int64 v20;
unsigned __int64 v21;
__m128i v22;
__int64 v23;
UINT8 *v24;
__int64 v25;
INT64 v26;
__int64 v27;
__int64 v28;
__int64 v29;
__int128 v30;
__int64 v31;
INT64 v32;
union _LARGE_INTEGER PerformanceFrequency;
int v34;
UINT8 *dst;
__m128i v36;
__int64 v37;
unsigned int v38;
v34 = 0;
PerformanceFrequency.QuadPart = 0i64;
v37 = 0i64;
v38 = 0;
IsWow64Logger = EtwpIsWow64Logger(a1);
result = *(unsigned int *)(a1 + 4);
v7 = *(_WORD *)(v6 + 168) + *(_WORD *)(v6 + 152) + (IsWow64Logger ? 276 : 284);
if( result >= (unsigned __int64)v7 + 104 )
{
if( ((int(__fastcall *)(__int64, __int64, __int64 *, int *))off_140C00A68[0])(25i64, 12i64, &v37, &v34) < 0 )
{
v37 = 0i64;
v38 = 0;
}
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
*(_WORD *)(a2 + 78) = 0;
v9 = (_QWORD *)(a1 + 328);
*(_WORD *)(a2 + 76) = v7 + 32;
*(_DWORD *)(a2 + 72) = -1073610750;
*(_DWORD *)(a2 + 80) = *((_DWORD *)CurrentThread + 288);
*(_DWORD *)(a2 + 84) = *((_DWORD *)CurrentThread + 286);
*(_DWORD *)(a2 + 96) = *((_DWORD *)CurrentThread + 163);
*(_DWORD *)(a2 + 100) = *((_DWORD *)CurrentThread + 183);
*(_QWORD *)(a2 + 88) = *(_QWORD *)(a1 + 328);
memset(a2 + 104, 0i64);
*(_DWORD *)(a2 + 104) = *(_DWORD *)(a1 + 4);
*(_WORD *)(a2 + 108) = 10;
*(_DWORD *)(a2 + 112) = (unsigned __int16)NtBuildNumber;
UsedProcessorCount = EtwpQueryUsedProcessorCount(a1);
*(_DWORD *)(a2 + 116) = UsedProcessorCount;
if( (*(_DWORD *)(a1 + 12) & 0x4000000) != 0 || *(_DWORD *)(a1 + 4) > 0x100000u || UsedProcessorCount > 0x100 )
{
v11 = 0;
v12 = 2;
}
else
{
v11 = 5;
v12 = 1;
}
*(_BYTE *)(a2 + 110) = v12;
*(_BYTE *)(a2 + 111) = v11;
*(_DWORD *)(a2 + 144) = 1;
*(_DWORD *)(a2 + 136) = *(_DWORD *)(a1 + 12) & 0xFF3FFEFF;
*(_DWORD *)(a2 + 132) = *(_DWORD *)(a1 + 308);
*(_DWORD *)(a2 + 128) = KeMaximumIncrement;
*(_DWORD *)(a2 + 156) = EtwCPUSpeedInMHz;
KeQueryPerformanceCounter(&PerformanceFrequency);
_InterlockedExchange64((volatile __int64 *)&EtwPerfFreq, PerformanceFrequency.QuadPart);
v13 = !EtwpIsWow64Logger(a1);
v14 = 1;
v15 = PerformanceFrequency;
if( v13 )
{
*(union _LARGE_INTEGER *)(a2 + 360) = PerformanceFrequency;
*(_QWORD *)(a2 + 368) = *(_QWORD *)(a1 + 320);
*(_QWORD *)(a2 + 352) = EtwpBootTime;
*(_DWORD *)(a2 + 148) = 8;
if( *(_DWORD *)(a1 + 216) != 4 )
v14 = *(_DWORD *)(a1 + 216);
*(_DWORD *)(a2 + 376) = v14;
*(_QWORD *)(a2 + 160) = HIDWORD(v37);
*(_QWORD *)(a2 + 168) = v38;
v16 = *(unsigned __int16 *)(a1 + 152);
dst = (UINT8 *)(a2 + 384);
v17 = a2 + 384 + v16;
v18 = 104i64;
}
else
{
*(_DWORD *)(a2 + 72) = -1073676286;
*(union _LARGE_INTEGER *)(a2 + 352) = v15;
*(_DWORD *)(a2 + 148) = 4;
*(_QWORD *)(a2 + 360) = *(_QWORD *)(a1 + 320);
*(_QWORD *)(a2 + 344) = EtwpBootTime;
if( *(_DWORD *)(a1 + 216) != 4 )
v14 = *(_DWORD *)(a1 + 216);
*(_DWORD *)(a2 + 368) = v14;
*(_DWORD *)(a2 + 160) = HIDWORD(v37);
*(_DWORD *)(a2 + 164) = v38;
v31 = *(unsigned __int16 *)(a1 + 152);
dst = (UINT8 *)(a2 + 376);
v17 = a2 + 376 + v31;
v18 = 96i64;
}
v19 = v18 + a2;
RtlpQueryTimeZoneInformationWorker((_RTL_DYNAMIC_TIME_ZONE_INFORMATION *)(v18 + a2 + 72), 0xACui64);
v20 = *(_QWORD *)(v19 + 140);
v21 = _mm_srli_si128(*(__m128i *)(v19 + 140), 8).m128i_u64[0];
*(_WORD *)(v19 + 140) = v20;
*(_WORD *)(v19 + 150) = v21;
*(_WORD *)(v19 + 142) = WORD1(v20);
*(_WORD *)(v19 + 146) = WORD2(v20);
*(_WORD *)(v19 + 144) = HIWORD(v21);
*(_WORD *)(v19 + 152) = WORD1(v21);
*(_WORD *)(v19 + 148) = HIWORD(v20);
*(_WORD *)(v19 + 154) = WORD2(v21);
v22 = *(__m128i *)(v19 + 224);
v23 = *(_QWORD *)(v19 + 224);
*(_DWORD *)(v19 + 224) = v23;
*(_WORD *)(v19 + 230) = WORD2(v23);
*(_WORD *)(v19 + 232) = HIWORD(v23);
v36 = v22;
v22.m128i_i64[0] = _mm_srli_si128(v22, 8).m128i_u64[0];
*(_WORD *)(v19 + 234) = v22.m128i_i16[0];
*(_WORD *)(v19 + 228) = v22.m128i_i16[3];
*(_WORD *)(v19 + 238) = v22.m128i_i16[2];
v24 = dst;
*(_WORD *)(v19 + 236) = v22.m128i_i16[1];
memmove(v24, *(UINT8 **)(a1 + 160), *(unsigned __int16 *)(a1 + 152) + 2i64);
memmove((UINT8 *)(v17 + 2), *(UINT8 **)(a1 + 176), *(unsigned __int16 *)(a1 + 168) + 2i64);
*(_DWORD *)(a2 + 8) += (v7 + 39) & 0xFFFFFFF8;
if( (*(_DWORD *)(a1 + 12) & 0x2000000) != 0 && (unsigned int)(*(_DWORD *)(a2 + 8) + 68) <= *(_DWORD *)a2 )
{
v27 = a2 + *(unsigned int *)(a2 + 8);
*(_DWORD *)(v27 + 4) = 327748;
*(_DWORD *)v27 = -1073610750;
*(_DWORD *)(v27 + 8) = *((_DWORD *)CurrentThread + 288);
*(_DWORD *)(v27 + 12) = *((_DWORD *)CurrentThread + 286);
*(_DWORD *)(v27 + 24) = *((_DWORD *)CurrentThread + 163);
*(_DWORD *)(v27 + 28) = *((_DWORD *)CurrentThread + 183);
*(_QWORD *)(v27 + 16) = *v9;
v28 = *(_QWORD *)(a1 + 1080);
v29 = 32i64 * *(unsigned __int8 *)(a1 + 834);
*(_OWORD *)(v27 + 32) = *(_OWORD *)(v29 + v28 + 4260);
v30 = *(_OWORD *)(v29 + v28 + 4276);
*(_DWORD *)(v27 + 64) = 80;
*(_OWORD *)(v27 + 48) = v30;
*(_DWORD *)(a2 + 8) += 72;
}
if( (unsigned int)(*(_DWORD *)(a2 + 8) + 80) <= *(_DWORD *)a2 )
{
v25 = a2 + *(unsigned int *)(a2 + 8);
*(_DWORD *)(v25 + 4) = 5242960;
*(_DWORD *)v25 = -1073610750;
*(_DWORD *)(v25 + 8) = *((_DWORD *)CurrentThread + 288);
*(_DWORD *)(v25 + 12) = *((_DWORD *)CurrentThread + 286);
*(_DWORD *)(v25 + 24) = *((_DWORD *)CurrentThread + 163);
*(_DWORD *)(v25 + 28) = *((_DWORD *)CurrentThread + 183);
*(_QWORD *)(v25 + 16) = *v9;
*(_DWORD *)(v25 + 32) = 0;
*(_DWORD *)(v25 + 36) = *(_DWORD *)(*(_QWORD *)(a1 + 1080) + 4204i64);
*(_OWORD *)(v25 + 48) = *(_OWORD *)(*(_QWORD *)(a1 + 1080) + 4152i64);
*(_QWORD *)(v25 + 40) = *(_QWORD *)(a1 + 1264);
*(_OWORD *)(v25 + 64) = *(_OWORD *)(*(_QWORD *)(a1 + 1080) + 4168i64);
*(_DWORD *)(a2 + 8) += 80;
}
v26 = *(unsigned int *)a2;
*(_DWORD *)(a2 + 48) = *(_DWORD *)(a2 + 8);
if( *(_DWORD *)(a2 + 8) < (unsigned int)v26 )
{
if( *(_QWORD *)(a1 + 112) != a1 + 112 || *(_DWORD *)(a1 + 136) )
{
LODWORD(v32) = 3;
EtwpAddDebugInfoEvents(a1, a2, v26, (INT64 *)(a1 + 328), v32);
}
if( *(_QWORD *)(a1 + 1024) != a1 + 1024 )
EtwpAddBinaryInfoEvents((_WMI_LOGGER_CONTEXT *)a1, (_WMI_BUFFER_HEADER *)a2, *(unsigned int *)a2);
}
*(_DWORD *)(a2 + 4) = *(_DWORD *)(a2 + 48);
*(_DWORD *)(a2 + 44) = 3;
EtwpPrepareHeader(a1, a2, 1);
result = *(unsigned int *)(a2 + 8);
*(_DWORD *)(a2 + 4) = result;
}
return result;
}Referenced by:
EtwpPreserveLogger
EtwpUpdateFileHeader