EtwpGetLoggerInfoFromContext

INT64 __fastcall EtwpGetLoggerInfoFromContext(INT64 a1, INT64 a2){
  unsigned int v4; 
  __int64 v5; 
  __int16 v6; 
  __int64 v7; 
  char v8; 
  UNICODE_STRING *v9; 
  __int64 v10; 
  char v11; 
  __int64 v12; 
  UNICODE_STRING *v13; 
  _PERFINFO_GROUPMASK GroupMask; 
  if( (*(_DWORD *)(a2 + 12) & 0x2000000) != 0 )
  {
    GroupMask = *(_PERFINFO_GROUPMASK *)(32i64 * *(unsigned __int8 *)(a2 + 834) + *(_QWORD *)(a2 + 1080) + 4260);
    EtwpMapEnableFlags(&GroupMask, 0);
    *(_DWORD *)(a1 + 72) = GroupMask.Masks[0];
  }
  else
  {
    *(_DWORD *)(a1 + 72) = 0;
  }
  *(_OWORD *)(a1 + 24) = *(_OWORD *)(a2 + 292);
  *(_DWORD *)(a1 + 64) = *(_DWORD *)(a2 + 12);
  *(_DWORD *)(a1 + 60) = *(_DWORD *)(a2 + 308);
  *(_DWORD *)(a1 + 68) = *(_DWORD *)(a2 + 224);
  *(_DWORD *)(a1 + 48) = *(_DWORD *)(a2 + 4) >> 10;
  *(_DWORD *)(a1 + 96) = *(_DWORD *)(a2 + 248);
  *(_DWORD *)(a1 + 52) = *(_DWORD *)(a2 + 240);
  *(_DWORD *)(a1 + 56) = *(_DWORD *)(a2 + 252);
  *(_DWORD *)(a1 + 104) = *(_DWORD *)(a2 + 256);
  *(_DWORD *)(a1 + 100) = *(_DWORD *)(a2 + 244);
  v4 = *(_DWORD *)(a2 + 264);
  if( v4 <= *(_DWORD *)(a2 + 272) )
    v4 = *(_DWORD *)(a2 + 272);
  *(_DWORD *)(a1 + 108) = v4;
  *(_QWORD *)(a1 + 80) = 0i64;
  v5 = (*(_DWORD *)(a2 + 832) >> 4) & 1;
  *(_QWORD *)(a1 + 80) = v5;
  *(_QWORD *)(a1 + 80) = v5 | (*(_DWORD *)(a2 + 832) >> 26) & 2;
  *(_DWORD *)(a1 + 112) = *(_DWORD *)(a2 + 268);
  *(_DWORD *)(a1 + 116) = *(_DWORD *)(a2 + 276);
  *(_DWORD *)(a1 + 160) = *(_DWORD *)(a2 + 360);
  *(_DWORD *)(a1 + 76) = *(_DWORD *)(a2 + 228);
  if( *(_DWORD *)a2 )
    v6 = *(_WORD *)a2;
  else
    v6 = -1;
  *(_WORD *)(a1 + 8) = v6;
  v7 = *(_QWORD *)(a2 + 48);
  if( v7 )
    *(_QWORD *)(a1 + 120) = *(_QWORD *)(v7 + 1152);
  *(_DWORD *)(a1 + 40) = *(_DWORD *)(a2 + 216);
  v8 = *((_BYTE *)KeGetCurrentThread() + 562);
  ExAcquirePushLockExclusiveEx(a2 + 704, 0i64);
  v10 = *(unsigned __int16 *)(a2 + 168);
  if( (_WORD)v10 && *(_WORD *)(a1 + 130) )
  {
    if( v8 )
      ProbeForWrite(*(VOID **)(a1 + 136), v10 + 2, 2ui64);
    RtlCopyUnicodeString((UNICODE_STRING *)(a1 + 128), (UNICODE_STRING *)(a2 + 168), v9);
  }
  v11 = _InterlockedExchangeAdd64((volatile signed __int64 *)(a2 + 704), 0xFFFFFFFFFFFFFFFFui64);
  if( (v11 & 2) != 0 && (v11 & 4) == 0 )
    ExfTryToWakePushLock((volatile INT64 *)(a2 + 704));
  KeAbPostRelease((PVOID)(a2 + 704));
  v12 = *(unsigned __int16 *)(a2 + 152);
  if( (_WORD)v12
    && *(_WORD *)(a1 + 146)
    && !RtlEqualUnicodeString((UNICODE_STRING *)(a2 + 152), (UNICODE_STRING *)(a1 + 144), 0) )
  {
    if( v8 )
      ProbeForWrite(*(VOID **)(a1 + 152), v12 + 2, 2ui64);
    RtlCopyUnicodeString((UNICODE_STRING *)(a1 + 144), (UNICODE_STRING *)(a2 + 152), v13);
  }
  return 0i64;
}

Referenced by: