EtwpStartLogger
__int64 __fastcall EtwpStartLogger(__int64 a1, __int64 a2, WCHAR a3){
WCHAR v5;
int v6;
unsigned int v7;
unsigned int v8;
__int64 v9;
int FileName;
unsigned int v11;
__int64 v12;
__int64 v13;
_GUID v14;
__int64 v15;
__int64 v16;
__int64 v17;
__int64 v18;
_ETW_SILODRIVERSTATE *v19;
unsigned int v20;
unsigned int MaxLoggers;
_WMI_LOGGER_CONTEXT *v22;
_ETW_SILODRIVERSTATE *v23;
__int64 v24;
__int64 v25;
_WMI_LOGGER_CONTEXT *inited;
unsigned __int16 *FlagExtension;
WCHAR v28;
int v29;
int v30;
int v31;
int v32;
struct _UNICODE_STRING *v33;
int v34;
__int64 v35;
int v36;
int v37;
unsigned int v38;
unsigned int v39;
int v40;
unsigned int v41;
unsigned __int64 v42;
__int64 v43;
int v44;
_ETW_SILODRIVERSTATE *v45;
__int64 v46;
EVENT_DESCRIPTOR *v47;
UINT64 v48;
__int64 v50;
__int64 v51;
char v52;
__int64 v53;
unsigned int v54;
__int64 v55;
unsigned int v56;
WCHAR *v57;
bool v58;
unsigned int v59;
__int64 v60;
int v61;
int v62;
void *v63;
__int64 v64;
UINT64 v65;
const _GUID *v66;
PKSTART_ROUTINE StartRoutine;
PVOID StartContext;
UINT64 LoggerId;
unsigned int v70;
_ETW_SILODRIVERSTATE *SiloState;
struct _UNICODE_STRING DestinationString;
PSECURITY_DESCRIPTOR SecurityDescriptor;
struct _UNICODE_STRING UnicodeString;
int v75;
__int64 v76;
struct _SECURITY_QUALITY_OF_SERVICE ClientSecurityQos;
void *ThreadHandle;
__int128 v79;
struct _OBJECT_ATTRIBUTES ObjectAttributes;
_GUID Buf2;
struct _EVENT_DATA_DESCRIPTOR v82;
int *v83;
__int64 v84;
SiloState = (_ETW_SILODRIVERSTATE *)a1;
LODWORD(LoggerId) = 0;
ThreadHandle = 0i64;
*(_WORD *)(&ClientSecurityQos.EffectiveOnly + 1) = 0;
SecurityDescriptor = 0i64;
*(&ObjectAttributes.Length + 1) = 0;
*(&ObjectAttributes.Attributes + 1) = 0;
Buf2 = 0i64;
v70 = 8;
UnicodeString = 0i64;
DestinationString = 0i64;
v79 = 0i64;
RtlInitUnicodeString(&DestinationString, 0i64, a3);
RtlInitUnicodeString(&UnicodeString, 0i64, v5);
v6 = *(_DWORD *)(a2 + 64);
v7 = v6 & 0x9DECE5FF;
if( (*(_BYTE *)(a2 + 64) & 3) == 0 && ((v6 & 8) != 0 || (v6 & 4) != 0) )
v7 = *(_DWORD *)(a2 + 64) & 0x9DECE5FE | 1;
v8 = v7 | 0x80;
v9 = 0x1000000i64;
if( (v7 & 0x40000) == 0 )
v8 = v7;
if( (v8 & 0x80000) != 0 && (v8 & 0x1000000) != 0 )
v8 &= ~0x1000000u;
if( (v8 & 0x400) != 0 )
{
if( *(_QWORD *)(a2 + 136) || (v8 & 0x4000F) != 0 )
goto LABEL_132;
v54 = v8 & 0xFFFFFEFF;
if( (v8 & 0x100) == 0 )
v54 = v8;
v8 = v54;
if( *(_DWORD *)(a2 + 68) )
*(_DWORD *)(a2 + 68) = 0;
if( *(_DWORD *)(a2 + 76) )
*(_DWORD *)(a2 + 76) = 0;
}
if( (v8 & 3) == 3
|| (v8 & 0xC000) == 49152
|| (v8 & 0x700) == 0 && !*(_QWORD *)(a2 + 136)
|| (v8 & 6) == 6
|| (v8 & 2) != 0 && !*(_DWORD *)(a2 + 60)
|| (v8 & 0x20) != 0 && (!*(_DWORD *)(a2 + 60) || (v6 & 0xC) != 0)
|| (v8 & 0x40) != 0
&& ((*(_DWORD *)(a2 + 112) & 2) == 0 || (v8 & 0x402) == 0 && ((v8 & 0x100) == 0 || *(_QWORD *)(a2 + 136)))
|| (v8 & 0xC00000) == 12582912 )
{
goto LABEL_132;
}
if( (v8 & 8) != 0 )
{
if( !*(_QWORD *)(a2 + 136)
|| (v8 & 2) != 0
|| !*(_DWORD *)(a2 + 60)
|| (*(_DWORD *)(a2 + 112) & 2) != 0
|| (v6 & 0x2000000) != 0 )
{
goto LABEL_132;
}
v50 = *(_QWORD *)(a2 + 24) - *(_QWORD *)&SystemTraceControlGuid.Data1;
if( !v50 )
v50 = *(_QWORD *)(a2 + 32) - *(_QWORD *)SystemTraceControlGuid.Data4;
if( !v50 )
goto LABEL_132;
v51 = *(_QWORD *)(a2 + 24) - CKCLGuid;
if( !v51 )
v51 = *(_QWORD *)(a2 + 32) - 0x74F156D0633E71AFi64;
if( !v51 || (v8 & 4) != 0 )
goto LABEL_132;
}
if( (v6 & 0x3000000) == 50331648 || (v6 & 0x4000000) != 0 && (v6 & 0x400) == 0 || (v6 & 0x10000) != 0 )
goto LABEL_132;
if( (*(_BYTE *)(a2 + 80) & 4) != 0 )
{
if( !EtwpKsrCallbackObject )
{
FileName = -1073741637;
goto LABEL_244;
}
if( (v6 & 0x400) == 0 || (v6 & 0x1000000) != 0 )
goto LABEL_132;
}
FileName = EtwpValidateFlagExtension((unsigned int *)a2);
if( FileName < 0 )
goto LABEL_244;
v11 = ((v8 & 0x100 | 0x400) >> 3) | 0x40;
if( !*(_WORD *)(a2 + 128) )
v11 = (v8 & 0x100 | 0x400) >> 3;
if( !*(_WORD *)(a2 + 144) || !*(_QWORD *)(a2 + 152) )
goto LABEL_132;
FileName = EtwpCaptureString((_UNICODE_STRING *)(a2 + 144), &DestinationString);
if( FileName )
{
LABEL_244:
if( EtwEventEnabled(
EtwpEventTracingProvRegHandle,
(EVENT_DESCRIPTOR *)&ETW_EVENT_SESSION_START_FAILED,
(EVENT_DESCRIPTOR *)v9) )
{
LODWORD(StartContext) = v8;
LODWORD(StartRoutine) = FileName;
EtwpEventWriteTemplateAdmin(
v65,
&ETW_EVENT_SESSION_START_FAILED,
v66,
&DestinationString,
&UnicodeString,
(const INT64)StartRoutine,
(const UINT64)StartContext);
}
RtlFreeAnsiString(&DestinationString);
RtlFreeAnsiString(&UnicodeString);
EtwpFreeSecurityDescriptor(&SecurityDescriptor);
return(unsigned int)FileName;
}
if( !(unsigned int)EtwpLookupLoggerIdByName((_ETW_SILODRIVERSTATE *)a1, &DestinationString, &LoggerId) )
{
LABEL_211:
FileName = -1073741771;
goto LABEL_244;
}
v12 = *(_QWORD *)(a2 + 24) - *(_QWORD *)&NullGuid.Data1;
if( !v12 )
v12 = *(_QWORD *)(a2 + 32) - *(_QWORD *)NullGuid.Data4;
if( v12 )
{
Buf2 = *(_GUID *)(a2 + 24);
}
else
{
FileName = ExUuidCreate(&Buf2);
if( FileName < 0 )
goto LABEL_244;
}
if( (v8 & 0xC00000) == 0 )
{
if( *((_BYTE *)KeGetCurrentThread() + 562) && (unsigned int)MmGetSessionId(*((_QWORD *)KeGetCurrentThread() + 23)) )
v8 |= 0x400000u;
else
v8 |= 0x800000u;
}
v13 = *(_QWORD *)(a1 + 456);
v14 = Buf2;
v15 = *(_QWORD *)&Buf2.Data1 - *(_QWORD *)&SystemTraceControlGuid.Data1;
v76 = v13;
if( *(_QWORD *)&Buf2.Data1 == *(_QWORD *)&SystemTraceControlGuid.Data1 )
v15 = *(_QWORD *)Buf2.Data4 - *(_QWORD *)SystemTraceControlGuid.Data4;
if( !v15 )
goto LABEL_181;
v16 = *(_QWORD *)&Buf2.Data1 - CKCLGuid;
if( *(_QWORD *)&Buf2.Data1 == CKCLGuid )
v16 = *(_QWORD *)Buf2.Data4 - 0x74F156D0633E71AFi64;
if( !v16 )
{
LABEL_181:
RtlFreeAnsiString(&DestinationString);
v55 = *(_QWORD *)&v14.Data1 - *(_QWORD *)&SystemTraceControlGuid.Data1;
if( *(_QWORD *)&v14.Data1 == *(_QWORD *)&SystemTraceControlGuid.Data1 )
v55 = *(_QWORD *)v14.Data4 - *(_QWORD *)SystemTraceControlGuid.Data4;
if( v55 )
{
v56 = 2;
v70 = 1;
v57 = (WCHAR *)L"Circular Kernel Context Logger";
}
else
{
v56 = 0;
v70 = 0;
v57 = (WCHAR *)L"NT Kernel Logger";
}
LODWORD(LoggerId) = v56;
if( !RtlCreateUnicodeString(&DestinationString, v57) )
goto LABEL_228;
v8 |= 0x80u;
if( (v8 & 0x1000000) == 0 )
{
v58 = _InterlockedCompareExchange64((volatile signed __int64 *)(v13 + 8i64 * v56), v13 | 1, 1i64) == 1;
goto LABEL_191;
}
goto LABEL_132;
}
v17 = *(_QWORD *)&Buf2.Data1 - *(_QWORD *)&GlobalLoggerGuid.Data1;
if( *(_QWORD *)&Buf2.Data1 == *(_QWORD *)&GlobalLoggerGuid.Data1 )
v17 = *(_QWORD *)Buf2.Data4 - *(_QWORD *)GlobalLoggerGuid.Data4;
if( !v17 )
{
LODWORD(LoggerId) = 1;
if( !EtwpGetFlagExtension(a2, 1) )
goto LABEL_216;
if( (v8 & 0x1000000) == 0 )
{
RtlFreeAnsiString(&DestinationString);
if( !RtlCreateUnicodeString(&DestinationString, (PWCHAR)L"NT Kernel Logger") )
goto LABEL_228;
v70 = 0;
LABEL_216:
v58 = _InterlockedCompareExchange64((volatile signed __int64 *)(v13 + 8), v13 | 1, 1i64) == 1;
LABEL_191:
if( v58 )
{
v23 = SiloState;
goto LABEL_58;
}
goto LABEL_211;
}
LABEL_132:
FileName = -1073741811;
goto LABEL_244;
}
v18 = *(_QWORD *)&Buf2.Data1 - AuditLoggerGuid;
if( *(_QWORD *)&Buf2.Data1 == AuditLoggerGuid )
v18 = *(_QWORD *)Buf2.Data4 + 0x6A2DF162E6CE8D6Ei64;
if( !v18 )
{
LODWORD(LoggerId) = 3;
if( (v8 & 0x1000000) == 0 )
{
RtlFreeAnsiString(&DestinationString);
if( RtlCreateUnicodeString(&DestinationString, (PWCHAR)L"Eventlog-Security") )
{
v8 |= 0x80u;
v58 = _InterlockedCompareExchange64((volatile signed __int64 *)(v13 + 24), v13 | 1, 1i64) == 1;
goto LABEL_191;
}
LABEL_228:
FileName = -1073741801;
goto LABEL_244;
}
goto LABEL_132;
}
if( !wcsicmp(DestinationString.Buffer, L"Eventlog-Security") )
{
v60 = *(_QWORD *)&v14.Data1 - AuditLoggerGuid;
if( *(_QWORD *)&v14.Data1 == AuditLoggerGuid )
v60 = *(_QWORD *)v14.Data4 + 0x6A2DF162E6CE8D6Ei64;
if( v60 )
goto LABEL_211;
}
v19 = SiloState;
v20 = 4;
MaxLoggers = SiloState->MaxLoggers;
if( MaxLoggers <= 4 )
{
LABEL_51:
v23 = v19;
goto LABEL_52;
}
while( 1 )
{
v22 = EtwpAcquireLoggerContextByLoggerId(v19, v20, 0);
if( v22 )
break;
LABEL_50:
v19 = SiloState;
++v20;
MaxLoggers = SiloState->MaxLoggers;
if( v20 >= MaxLoggers )
goto LABEL_51;
}
v43 = *(_QWORD *)((char *)v22 + 292) - *(_QWORD *)&v14.Data1;
if( !v43 )
v43 = *(_QWORD *)((char *)v22 + 300) - *(_QWORD *)v14.Data4;
if( v43 )
{
EtwpReleaseLoggerContext((unsigned int *)v22, 0);
goto LABEL_50;
}
EtwpReleaseLoggerContext((unsigned int *)v22, 0);
v23 = SiloState;
MaxLoggers = SiloState->MaxLoggers;
LABEL_52:
if( v20 < MaxLoggers )
goto LABEL_211;
LODWORD(LoggerId) = 4;
if( MaxLoggers > 4 )
{
v9 = v76;
v24 = v76 | 1;
do
{
if( _InterlockedCompareExchange64((volatile signed __int64 *)(v9 + 8i64 * (unsigned int)LoggerId), v24, 1i64) == 1 )
break;
LODWORD(LoggerId) = LoggerId + 1;
}
while( (unsigned int)LoggerId < v23->MaxLoggers );
}
if( (unsigned int)LoggerId >= v23->MaxLoggers )
{
if( !byte_140CF7320 )
{
byte_140CF7320 = 1;
if( (unsigned int)dword_140C02BB0 > 5 )
{
if( tlgKeywordOn((__int64)&dword_140C02BB0, 0x800000000000i64) )
{
v75 = v61;
v83 = &v75;
v84 = 4i64;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&dword_140C02BB0,
(unsigned __int8 *)&dword_14002C31C,
0i64,
0i64,
3u,
&v82);
}
}
}
FileName = -1073741670;
goto LABEL_244;
}
LABEL_58:
ExAcquireRundownProtectionCacheAwareEx(v23->EtwpLoggerRundown[(unsigned int)LoggerId], 1u);
EtwpGetSecurityDescriptorByGuid(&Buf2, &SecurityDescriptor);
FileName = EtwpAccessCheck(SecurityDescriptor, v11, 0i64);
if( FileName < 0 )
goto LABEL_243;
v25 = HeapGuid - *(_QWORD *)&Buf2.Data1;
if( HeapGuid == *(_QWORD *)&Buf2.Data1 )
v25 = 0x4AA2F2756B3425A8i64 - *(_QWORD *)Buf2.Data4;
if( v25 )
BYTE4(LoggerId) = memcmp(&CritSecGuid, &Buf2, 0x10ui64) != 0 ? 9 : 1;
else
BYTE4(LoggerId) = 0;
if( (*(_DWORD *)(a2 + 64) & 0x2000000) != 0 && v70 == 8 )
{
FileName = EtwpCheckCurrentUserGuidAccess((PVOID)&SystemTraceControlGuid, (PVOID)0x80);
if( FileName < 0 )
goto LABEL_243;
v59 = 2;
v70 = 2;
do
{
if( !_bittest((const signed __int32 *)&v23->SystemLoggerSettings.EtwpActiveSystemLoggers, v59) )
break;
++v59;
}
while( v59 < 8 );
v70 = v59;
if( v59 == 8 )
{
FileName = -1073741670;
goto LABEL_243;
}
}
inited = EtwpInitLoggerContext(&DestinationString, v8);
FlagExtension = EtwpGetFlagExtension(a2, 6);
if( FlagExtension )
{
if( 4 * *FlagExtension == 12 )
{
FileName = EtwpSetPartitionContext((INT64 *)inited + 163, *(_QWORD *)(FlagExtension + 2));
if( FileName < 0 )
goto LABEL_234;
}
}
RtlFreeAnsiString(&DestinationString);
if( !inited )
{
FileName = -1073741801;
LABEL_243:
v64 = (unsigned int)LoggerId;
ExReleaseRundownProtectionCacheAwareEx(SiloState->EtwpLoggerRundown[(unsigned int)LoggerId], 1u);
_InterlockedExchange64((volatile __int64 *)(v76 + 8 * v64), 1i64);
goto LABEL_244;
}
*(_GUID *)((char *)inited + 292) = Buf2;
*((_DWORD *)inited + 77) = *(_DWORD *)(a2 + 60);
if( (*(_BYTE *)(a2 + 80) & 1) != 0 )
_InterlockedOr((volatile signed __int32 *)inited + 208, 0x10u);
*((_DWORD *)inited + 54) = *(_DWORD *)(a2 + 40);
if( (*(_BYTE *)(a2 + 80) & 2) != 0 )
{
FileName = EtwpSetQpcDeltaTracking((INT64)inited);
if( FileName < 0 )
goto LABEL_234;
}
if( (*(_BYTE *)(a2 + 80) & 8) != 0 )
*((_DWORD *)inited + 208) |= 0x40000000u;
v29 = *(_DWORD *)(a2 + 68);
if( v29 )
{
*((_DWORD *)inited + 56) = v29;
}
else if( (v8 & 0x100) != 0 )
{
*((_DWORD *)inited + 56) = (v8 & 0x10) != 0 ? 1000 : 1;
}
v30 = *(_DWORD *)(a2 + 76);
v31 = v30;
if( v30 && (*((_DWORD *)inited + 56) || v30 < 0) )
{
*(_DWORD *)(a2 + 76) = 0;
v31 = 0;
}
v32 = LoggerId;
*((_DWORD *)inited + 57) = v31;
*(_DWORD *)inited = v32;
*((_QWORD *)inited + 135) = v23;
if( *(_WORD *)(a2 + 128) )
{
if( *(_QWORD *)(a2 + 136) )
{
FileName = EtwpCaptureString((_UNICODE_STRING *)(a2 + 128), &UnicodeString);
if( FileName < 0 )
goto LABEL_234;
}
}
if( (*(_DWORD *)(a2 + 112) & 2) != 0 )
{
*((_DWORD *)inited + 78) = *(_DWORD *)(a2 + 96);
*(_DWORD *)(a2 + 96) = 0;
}
v33 = (struct _UNICODE_STRING *)((char *)inited + 168);
if( (*((_DWORD *)inited + 3) & 8) != 0 )
{
*(struct _UNICODE_STRING *)((char *)inited + 184) = UnicodeString;
RtlInitUnicodeString(&UnicodeString, 0i64, v28);
FileName = EtwpGenerateFileName(
(_UNICODE_STRING *)((char *)inited + 184),
(INT64 *)inited + 39,
(_UNICODE_STRING *)((char *)inited + 168));
if( FileName < 0 )
goto LABEL_234;
v23 = SiloState;
}
else
{
*v33 = UnicodeString;
RtlInitUnicodeString(&UnicodeString, 0i64, v28);
}
ClientSecurityQos.ImpersonationLevel = SecurityImpersonation;
ClientSecurityQos.Length = 12;
*(_WORD *)&ClientSecurityQos.ContextTrackingMode = 257;
FileName = SeCreateClientSecurity(KeGetCurrentThread(), &ClientSecurityQos, 0, (PSECURITY_CLIENT_CONTEXT)inited + 10);
if( FileName < 0 )
goto LABEL_234;
if( (*((_DWORD *)inited + 3) & 0x100) != 0 )
_InterlockedOr((volatile signed __int32 *)inited + 208, 8u);
else
_InterlockedAnd((volatile signed __int32 *)inited + 208, 0xFFFFFFF7);
v34 = *(_DWORD *)(a2 + 112);
if( (v34 & 2) != 0 )
{
_InterlockedOr((volatile signed __int32 *)inited + 208, 2u);
v34 = *(_DWORD *)(a2 + 112);
}
if( (v34 & 1) != 0 )
{
_InterlockedOr((volatile signed __int32 *)inited + 208, 1u);
v34 = *(_DWORD *)(a2 + 112);
}
if( (v34 & 0x4000) != 0 )
_InterlockedOr((volatile signed __int32 *)inited + 208, 0x4000u);
EtwpInitializeTimeStamp(inited);
v35 = v70;
if( v70 < 8 )
{
*((_DWORD *)inited + 3) |= 0x2000000u;
*((_BYTE *)inited + 834) = v35;
if( (unsigned int)v35 <= 1 )
_InterlockedOr((volatile signed __int32 *)inited + 208, 0x20u);
v23->SystemLoggerSettings.EtwpSystemLogger[v35].LoggerId = LoggerId;
if( (unsigned int)(*((_DWORD *)inited + 54) - 1) >= 4 )
v52 = 1;
else
v52 = *((_BYTE *)inited + 216);
v23->SystemLoggerSettings.EtwpSystemLogger[v35].ClockType = v52;
_interlockedbittestandset((volatile signed __int32 *)&v23->SystemLoggerSettings.EtwpActiveSystemLoggers, v35);
}
FileName = EtwpCheckForStackTracingExtension(a2, (RTL_BITMAP *)inited);
if( FileName < 0 )
goto LABEL_234;
v36 = *(_DWORD *)(a2 + 52);
if( v36 )
*((_DWORD *)inited + 60) = v36;
v37 = *(_DWORD *)(a2 + 56);
if( v37 )
*((_DWORD *)inited + 63) = v37;
v38 = *(_DWORD *)(a2 + 48);
if( v38 )
{
if( v38 > 0x4000 )
{
*(_DWORD *)(a2 + 48) = 0x4000;
v38 = 0x4000;
}
*((_DWORD *)inited + 1) = v38 << 10;
}
if( (*(_BYTE *)(a2 + 80) & 4) != 0 )
{
*((_DWORD *)inited + 1) = (*((_DWORD *)inited + 1) + 0x1FFFFF) & 0xFFE00000;
_InterlockedOr((volatile signed __int32 *)inited + 208, 0x20000000u);
}
if( v33->Length )
{
_InterlockedOr((volatile signed __int32 *)inited + 209, 1u);
*((_QWORD *)inited + 6) = KeGetCurrentThread();
FileName = EtwpCreateLogFile(inited, 0);
if( FileName < 0 )
{
LABEL_234:
if( (*((_DWORD *)inited + 3) & 0x2000000) != 0 )
_interlockedbittestandreset(
(volatile signed __int32 *)&SiloState->SystemLoggerSettings.EtwpActiveSystemLoggers,
v70);
v62 = *((_DWORD *)inited + 208);
if( (v62 & 0x80u) != 0 )
{
ExFreePoolWithTag(*((PVOID *)inited + 123), 0);
v62 = *((_DWORD *)inited + 208);
}
if( (v62 & 0x2000) != 0 )
_InterlockedDecrement(&dword_140C53AA0);
RtlFreeAnsiString((_UNICODE_STRING *)((char *)inited + 168));
RtlFreeAnsiString((_UNICODE_STRING *)((char *)inited + 184));
v63 = (void *)*((_QWORD *)inited + 102);
if( v63 )
ZwClose(v63);
ExFreePoolWithTag(inited, 0);
goto LABEL_243;
}
}
v39 = *((_DWORD *)inited + 1);
if( v39 < 0x1000 && (v33->Length || (*((_DWORD *)inited + 3) & 0x400) != 0) )
{
_InterlockedOr((volatile signed __int32 *)inited + 208, 0x1000u);
v39 = *((_DWORD *)inited + 1);
}
v40 = 0xFFFF;
if( (unsigned __int64)v39 - 72 < 0xFFFF )
v40 = v39 - 72;
*((_DWORD *)inited + 2) = v40 & 0xFFFFFFF8;
FileName = EtwpAllocateTraceBufferPool(inited);
if( FileName < 0 )
goto LABEL_255;
v41 = *((_DWORD *)inited + 77);
if( !v41 || (*((_DWORD *)inited + 3) & 0x2000) != 0 )
v42 = 10485760i64;
else
v42 = (unsigned __int64)v41 << 20;
v44 = *((_DWORD *)inited + 1) * *((_DWORD *)inited + 63);
if( v42 <= (unsigned int)(2 * v44) )
v42 = (unsigned int)(2 * v44);
*((_QWORD *)inited + 54) = v42;
FileName = EtwpInitializeLoggerSecurityDescriptor((__int64)inited, SecurityDescriptor);
EtwpFreeSecurityDescriptor(&SecurityDescriptor);
if( FileName < 0 )
{
LABEL_255:
EtwpFreeTraceBufferPool((UINT64 *)inited);
goto LABEL_234;
}
_InterlockedAdd(&v23->EtwpCounters.SessionCount, 1u);
v45 = SiloState;
v46 = (unsigned int)LoggerId;
ExAcquireRundownProtectionCacheAwareEx(SiloState->EtwpLoggerRundown[(unsigned int)LoggerId], 1u);
if( (*((_DWORD *)inited + 3) & 0x400) != 0 )
{
LABEL_123:
if( EtwEventEnabled(EtwpEventTracingProvRegHandle, (EVENT_DESCRIPTOR *)&ETW_EVENT_START_TRACE, v47) )
EtwpEventWriteTemplateSession(v48, &ETW_EVENT_START_TRACE, inited);
KeWaitForSingleObject((char *)inited + 648, Executive, 0, 0, 0i64);
_InterlockedExchange64((volatile __int64 *)(v76 + 8 * v46), (__int64)inited);
EtwpSendSessionNotification((__int64)inited, 5u, 0);
if( (*((_DWORD *)inited + 3) & 0x2000000) == 0 )
goto LABEL_126;
if( v45 == (_ETW_SILODRIVERSTATE *)EtwpHostSiloState )
{
FileName = EtwpCheckForPoolTagFilterExtension((__int64)inited, a2, 1);
if( FileName < 0 )
goto LABEL_258;
v53 = 5i64 * v70;
*((_WORD *)EtwpObjectTypeFilter + 2 * v53) = 1;
*((_DWORD *)EtwpObjectTypeFilter + v53 + 1) = 42;
}
FileName = EtwpUpdateLoggerGroupMasks((__int64)inited, a2);
if( FileName >= 0 )
{
LABEL_126:
if( BYTE4(LoggerId) != 9 )
EtwpUpdatePerProcessTracing(a2, (__int64)v45, *(_DWORD *)inited, BYTE4(LoggerId));
EtwpGetLoggerInfoFromContext(a2, (INT64)inited);
EtwpReleaseLoggerContext((unsigned int *)inited, 1);
return(unsigned int)FileName;
}
LABEL_258:
*((_DWORD *)inited + 14) = FileName;
EtwpStopLoggerInstance(inited);
if( (*((_DWORD *)inited + 3) & 0x400) != 0 )
{
EtwpGetLoggerInfoFromContext(a2, (INT64)inited);
EtwpReleaseLoggerContext((unsigned int *)inited, 1);
goto LABEL_257;
}
goto LABEL_126;
}
ObjectAttributes.Length = 48;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = 512;
ObjectAttributes.ObjectName = 0i64;
*(_QWORD *)&v79 = PsGetCurrentServerSilo();
*((_QWORD *)&v79 + 1) = inited;
FileName = PsCreateSystemThread(
&ThreadHandle,
0x1FFFFFu,
&ObjectAttributes,
0i64,
0i64,
(PKSTART_ROUTINE)EtwpLogger,
&v79);
if( FileName >= 0 )
{
ZwClose(ThreadHandle);
FileName = KeWaitForSingleObject((char *)inited + 472, Executive, 0, 0, 0i64);
goto LABEL_123;
}
ExReleaseRundownProtectionCacheAwareEx(v45->EtwpLoggerRundown[v46], 1u);
LABEL_257:
EtwpFreeLoggerContext(inited);
return(unsigned int)FileName;
}Referenced by:
EtwStartAutoLogger
EtwpStartTrace