EtwpSendDataBlock

INT64 __fastcall EtwpSendDataBlock(_ETW_REG_ENTRY *RegEntry, _ETWP_NOTIFICATION_HEADER *DataBlock){
  unsigned __int16 Flags; 
  __int128 *v5; 
  struct _DMA_ADAPTER *v6; 
  NTSTATUS v7; 
  _EPROCESS *Process; 
  volatile unsigned __int64 TickCountQuad; 
  _ETW_NOTIFICATION_TYPE NotificationType; 
  __int64 v12; 
  char v13; 
  unsigned __int64 v14; 
  unsigned int v15; 
  __int64 v16; 
  volatile unsigned __int64 v17; 
  _ETW_GUID_ENTRY *GuidEntry; 
  _EPROCESS *v19; 
  char Level; 
  int LowPart; 
  int HighPart; 
  void(__fastcall *Callback)(_GUID *, _EPROCESS *, unsigned __int16 *, _EPROCESS *); 
  int *p_Data2; 
  struct _DMA_ADAPTER *v25; 
  int v26; 
  __int64 v27; 
  _ETW_GUID_ENTRY *v28; 
  void(__fastcall *v29)(_GUID *, _QWORD, __int64, __int64, unsigned __int64, __int128 *, _EPROCESS *); 
  _EPROCESS *v30; 
  __int64 v31; 
  __int64 v32; 
  unsigned __int16 LoggerId; 
  char v34; 
  char v35; 
  int v36; 
  int v37; 
  int v38; 
  __int128 v39; 
  KAPC_STATE ApcState; 
  struct _EVENT_DATA_DESCRIPTOR v41; 
  __int64 *v42; 
  __int64 v43; 
  __int64 *v44; 
  __int64 v45; 
  _GUID *p_Guid; 
  __int64 v47; 
  Flags = RegEntry->Flags;
  v5 = 0i64;
  v6 = 0i64;
  v7 = 0;
  memset(&ApcState, 0, sizeof(ApcState));
  v39 = 0i64;
  if( (Flags & 1) != 0 )
  {
    Process = RegEntry->Process;
    v30 = Process;
    if( RegEntry->Callback )
    {
      TickCountQuad = KUSER_SHARED_DATA.TickCountQuad;
      if( (RegEntry->Flags & 0x10) != 0 )
      {
        LODWORD(v25) = MmGetSessionById(RegEntry->SessionId);
        v6 = v25;
        if( !v25 )
          return(unsigned int)-1073741275;
        v7 = MmAttachSession(v25, &ApcState);
        if( v7 < 0 )
        {
          HalPutDmaAdapter(v6);
          return(unsigned int)v7;
        }
        Process = v30;
        v5 = 0i64;
      }
      if( DataBlock->NotificationType == EtwNotificationTypeEnable )
      {
        if( (RegEntry->Flags & 8) != 0 )
        {
          GuidEntry = RegEntry->GuidEntry;
          v19 = Process;
          LOBYTE(Process) = DataBlock[1].DestinationGuid.Data1;
          Level = GuidEntry->LastEnable.Level;
          LowPart = GuidEntry->LastEnable.EnableFlags.LowPart;
          HighPart = GuidEntry->LastEnable.EnableFlags.HighPart;
          LoggerId = GuidEntry->LastEnable.LoggerId;
          Callback = (void(__fastcall *)(_GUID *, _EPROCESS *, unsigned __int16 *, _EPROCESS *))RegEntry->Callback;
          v34 = Level;
          v36 = LowPart;
          v35 = 0;
          v37 = HighPart;
          v38 = 0;
          Callback(&GuidEntry->Guid, Process, &LoggerId, v19);
        }
        else
        {
          NotificationType = DataBlock[1].NotificationType;
          v12 = *(unsigned int *)&DataBlock[1].DestinationGuid.Data2;
          v29 = (void(__fastcall *)(_GUID *, _QWORD, __int64, __int64, unsigned __int64, __int128 *, _EPROCESS *))RegEntry->Callback;
          v13 = NotificationType != 0 ? LOBYTE(DataBlock[1].NotificationSize) : 0;
          v14 = DataBlock[1].ReplyHandle & -(__int64)(NotificationType != 0);
          v15 = 0;
          v16 = *(_QWORD *)&DataBlock[1].ReplyIndex & -(__int64)(NotificationType != 0);
          if( (_DWORD)v12 )
          {
            p_Data2 = (int *)&DataBlock[1].SourceGuid.Data2;
            while( *p_Data2 < 0 && *p_Data2 != 0x80000000 )
            {
              ++v15;
              p_Data2 += 4;
              if( v15 >= (unsigned int)v12 )
                goto LABEL_10;
            }
            v26 = *(&DataBlock[1].SourceGuid.Data1 + 4 * v15);
            *(_QWORD *)&v39 = (char *)DataBlock + *(_QWORD *)&DataBlock[1].DestinationGuid.Data4[16 * v15];
            v5 = &v39;
            HIDWORD(v39) = *((_DWORD *)&DataBlock[1].SourceGuid.Data2 + 4 * v15);
            DWORD2(v39) = v26;
          }
LABEL_10:
          LOBYTE(v12) = v13;
          v29(&DataBlock->SourceGuid, (unsigned int)NotificationType, v12, v16, v14, v5, v30);
        }
      }
      else
      {
        v7 = -1073741811;
      }
      if( v6 )
      {
        MmDetachSession(v6, &ApcState);
        HalPutDmaAdapter(v6);
      }
      v17 = KUSER_SHARED_DATA.TickCountQuad;
      if( (__int64)((v17 - TickCountQuad) * KeQueryTimeIncrement()) >= 600010000
        && (unsigned int)dword_140C02BB0 > 5
        && tlgKeywordOn((__int64)&dword_140C02BB0, 0x200000000800i64) )
      {
        v43 = 8i64;
        v31 = 2164260864i64;
        v45 = 8i64;
        v42 = &v31;
        v47 = 16i64;
        v44 = &v32;
        v28 = RegEntry->GuidEntry;
        v32 = v27 / 10000;
        p_Guid = &v28->Guid;
        tlgWriteTransfer_EtwWriteTransfer(
          (__int64)&dword_140C02BB0,
          (unsigned __int8 *)byte_14002C91D,
          0i64,
          0i64,
          5u,
          &v41);
      }
    }
  }
  else if( (Flags & 2) != 0 )
  {
    return(unsigned int)EtwpQueueNotification(RegEntry->Process, DataBlock, RegEntry);
  }
  return(unsigned int)v7;
}

Referenced by: