IoWriteErrorLogEntry
VOID __stdcall IoWriteErrorLogEntry(PVOID ElEntry){
UINT64 v1;
char *v2;
unsigned __int8 v3;
unsigned __int64 v4;
INT64(__stdcall ***v5)(FILE_OBJECT *, FILE_OBJECT *);
INT64(__stdcall **v6)(FILE_OBJECT *, FILE_OBJECT *);
bool v7;
struct _DMA_ADAPTER *v8;
struct _DMA_ADAPTER *v9;
v2 = (char *)ElEntry - 48;
if( IopErrorLogDisabledThisBoot )
{
v8 = (struct _DMA_ADAPTER *)*((_QWORD *)v2 + 3);
if( v8 )
HalPutDmaAdapter(v8);
v9 = (struct _DMA_ADAPTER *)*((_QWORD *)v2 + 4);
if( v9 )
HalPutDmaAdapter(v9);
_InterlockedExchangeAdd(&IopErrorLogAllocation, -*((unsigned __int16 *)v2 + 1));
ExFreePoolWithTag(v2, 0);
}
else
{
*((_QWORD *)v2 + 5) = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
KeAcquireSpinLockRaiseToDpc(&IopErrorLogLock, v1);
v4 = v3;
v5 = (INT64(__stdcall ***)(FILE_OBJECT *, FILE_OBJECT *))qword_140C459B8;
v6 = (INT64(__stdcall **)(FILE_OBJECT *, FILE_OBJECT *))(v2 + 8);
if( *(INT64(__stdcall **)(FILE_OBJECT *, FILE_OBJECT *))qword_140C459B8 != IopErrorLogListHead )
__fastfail(3u);
v7 = IopErrorLogSessionPending == 0;
*v6 = IopErrorLogListHead;
v6[1] = (INT64(__stdcall *)(FILE_OBJECT *, FILE_OBJECT *))v5;
*v5 = v6;
qword_140C459B8 = (__int64)v6;
if( v7 )
{
IopErrorLogWorkItem.Parameter = 0i64;
IopErrorLogWorkItem.List.Flink = 0i64;
IopErrorLogWorkItem.WorkerRoutine = (void(__fastcall *)(void *))IopErrorLogThread;
IopErrorLogSessionPending = 1;
ExQueueWorkItem(&IopErrorLogWorkItem, DelayedWorkQueue);
}
KxReleaseSpinLock(&IopErrorLogLock);
__writecr8(v4);
}
}Referenced by:
FsRtlLogCcFlushError
IopDisassociateThreadIrp
IopLogBlockedDriverEvent
MiBadMemoryLogger
MiLogFailedDriverLoad
PnpLogEvent