EtwpUpdateFilterData
INT64 __fastcall EtwpUpdateFilterData(INT64 a1, UINT64 a2, INT64 a3, CHAR a4, INT64 a5){
unsigned int v5;
char *v8;
__int64 v9;
__int32 v10;
void *v11;
char *PoolWithTag;
__int64 v14;
__int32 v15;
__int64 v16;
__int32 v17;
__int64 v18;
unsigned int v19;
unsigned int v20;
unsigned __int64 v21;
char v22;
PVOID v23;
PVOID v24;
unsigned int v25;
_ETW_FILTER_EVENT_NAME_DATA *v26;
_ETW_FILTER_EVENT_NAME_DATA *v27;
int v28;
PVOID updated;
INT64 v30;
PVOID v31;
PVOID P;
int v33;
_EVENT_FILTER_DESCRIPTOR FilterData;
unsigned int v35;
char v37;
v35 = a2;
v5 = a2;
v25 = 0;
v37 = 0;
P = 0i64;
updated = 0i64;
v27 = 0i64;
v26 = 0i64;
v31 = 0i64;
v30 = 0i64;
if( !a3 || !*(_DWORD *)(a3 + 116) )
a4 = 1;
v8 = *(char **)(a1 + 384);
if( !a4 )
{
if( !v8 )
{
PoolWithTag = (char *)ExAllocatePoolWithTag(NonPagedPoolNx, 0x340ui64, 0x46777445ui64);
v8 = PoolWithTag;
if( !PoolWithTag )
return 3221225495i64;
memset((INT64)PoolWithTag, 0i64);
v5 = v35;
*(_QWORD *)(a1 + 384) = v8;
}
v14 = 104i64 * v5;
v15 = 0;
v16 = 0i64;
v28 = 0;
v17 = _InterlockedExchange((volatile __int32 *)&v8[v14], 0);
v33 = v17;
if( !*(_DWORD *)(a3 + 116) )
goto LABEL_62;
while( 1 )
{
v18 = 2 * v16;
v19 = *(_DWORD *)(a3 + 8 * v18 + 132);
v20 = *(_DWORD *)(a3 + 8 * v18 + 128);
v21 = a3 + *(_QWORD *)(a3 + 8 * v18 + 120);
FilterData.Size = v20;
FilterData.Type = v19;
FilterData.Ptr = v21;
if( v19 > 0x80000200 )
break;
if( v19 == -2147483136 )
{
updated = (PVOID)EtwpUpdateEventFilter(
(volatile INT64 *)(v14 + *(_QWORD *)(a1 + 384) + 72i64),
(INT64 *)(a5 + 32),
0);
v15 |= 0x80000200;
goto LABEL_59;
}
if( v19 != 0x80000000 )
{
if( v19 == -2147483644 )
{
EtwpUpdatePidFilterData((_ETW_FILTER_HEADER *)(v14 + *(_QWORD *)(a1 + 384)), &FilterData, 0);
v15 |= 0x80000004;
}
else if( v19 == -2147483640 )
{
EtwpUpdateStringFilterData((void **)(v14 + *(_QWORD *)(a1 + 384) + 16i64), (void **)a5, 0);
v15 |= 0x80000008;
}
else if( v19 == -2147483632 )
{
EtwpUpdateStringFilterData((void **)(v14 + *(_QWORD *)(a1 + 384) + 24i64), (void **)(a5 + 8), 0);
v15 |= 0x80000010;
}
else
{
if( v19 != -2147483616 )
{
if( v19 == -2147483392 )
{
v30 = EtwpUpdateEventFilter(
(volatile INT64 *)(v14 + *(_QWORD *)(a1 + 384) + 80i64),
(INT64 *)(a5 + 72),
0);
v15 |= 0x80000100;
}
goto LABEL_59;
}
EtwpUpdateStringFilterData((void **)(v14 + *(_QWORD *)(a1 + 384) + 32i64), (void **)(a5 + 16), 0);
v15 |= 0x80000020;
}
LABEL_43:
LOBYTE(v5) = v35;
goto LABEL_59;
}
EtwpUpdateSchematizedFilterData(v14 + *(_QWORD *)(a1 + 384), v5, (__int64)&FilterData, 0);
LOBYTE(v5) = v35;
v22 = 1;
v37 = 1;
LABEL_60:
v16 = (unsigned int)(v28 + 1);
v28 = v16;
if( (unsigned int)v16 >= *(_DWORD *)(a3 + 116) )
{
v17 = v33;
if( !v22 )
LABEL_62:
EtwpUpdateSchematizedFilterData(v14 + *(_QWORD *)(a1 + 384), 0, 0i64, 1);
if( (v17 & 0x80000004) == -2147483644 && (v15 & 0x80000004) != -2147483644 )
EtwpUpdatePidFilterData((_ETW_FILTER_HEADER *)(v14 + *(_QWORD *)(a1 + 384)), 0i64, 1u);
if( (v17 & 0x80000008) == -2147483640 && (v15 & 0x80000008) != -2147483640 )
EtwpUpdateStringFilterData((void **)(v14 + *(_QWORD *)(a1 + 384) + 16i64), 0i64, 1);
if( (v17 & 0x80000010) == -2147483632 && (v15 & 0x80000010) != -2147483632 )
EtwpUpdateStringFilterData((void **)(v14 + *(_QWORD *)(a1 + 384) + 24i64), 0i64, 1);
if( (v17 & 0x80000020) == -2147483616 && (v15 & 0x80000020) != -2147483616 )
EtwpUpdateStringFilterData((void **)(v14 + *(_QWORD *)(a1 + 384) + 32i64), 0i64, 1);
if( (v17 & 0x80008000) == -2147450880 && (v15 & 0x80008000) != -2147450880 )
EtwpUpdateStringFilterData((void **)(v14 + *(_QWORD *)(a1 + 384) + 40i64), 0i64, 1);
if( (v17 & 0x80001000) == -2147479552 && (v15 & 0x80001000) != -2147479552 )
P = (PVOID)EtwpUpdateEventFilter((volatile INT64 *)(v14 + *(_QWORD *)(a1 + 384) + 48i64), 0i64, 1);
if( (v17 & 0x80000200) == -2147483136 && (v15 & 0x80000200) != -2147483136 )
updated = (PVOID)EtwpUpdateEventFilter((volatile INT64 *)(v14 + *(_QWORD *)(a1 + 384) + 72i64), 0i64, 1);
if( (v17 & 0x80000400) == -2147482624 && (v15 & 0x80000400) != -2147482624 )
v27 = (_ETW_FILTER_EVENT_NAME_DATA *)EtwpUpdateEventFilter(
(volatile INT64 *)(v14 + *(_QWORD *)(a1 + 384) + 96i64),
0i64,
1);
if( (v17 & 0x80002000) == -2147475456 && (v15 & 0x80002000) != -2147475456 )
v26 = (_ETW_FILTER_EVENT_NAME_DATA *)EtwpUpdateEventFilter(
(volatile INT64 *)(v14 + *(_QWORD *)(a1 + 384) + 56i64),
0i64,
1);
if( (v17 & 0x80004000) == -2147467264 && (v15 & 0x80004000) != -2147467264 )
v25 = EtwpUpdateLevelKwFilter(v14 + *(_QWORD *)(a1 + 384), 0i64, 1, &v31);
if( (v17 & 0x80000100) != -2147483392 || (v15 & 0x80000100) == -2147483392 )
v11 = (void *)v30;
else
v11 = (void *)EtwpUpdateEventFilter((volatile INT64 *)(v14 + *(_QWORD *)(a1 + 384) + 80i64), 0i64, 1);
_InterlockedExchange((volatile __int32 *)(v14 + *(_QWORD *)(a1 + 384)), v15);
LABEL_99:
v23 = P;
v24 = v31;
if( P || updated || v27 || v26 || v31 || v11 )
{
KeGenericCallDpc((PKDEFERRED_ROUTINE)KeAbCrossThreadDeleteNopDpcRoutine, 0i64);
if( v23 )
ExFreePoolWithTag(v23, 0);
if( updated )
ExFreePoolWithTag(updated, 0);
if( v27 )
EtwpFreeEventNameFilter(v27);
if( v26 )
EtwpFreeEventNameFilter(v26);
if( v24 )
ExFreePoolWithTag(v24, 0);
if( v11 )
{
if( _InterlockedExchangeAdd((volatile signed __int32 *)v11, 0xFFFFFFFF) == 1 )
ExFreePoolWithTag(v11, 0);
}
}
return v25;
}
}
switch( v19 )
{
case 0x80000400:
v27 = (_ETW_FILTER_EVENT_NAME_DATA *)EtwpUpdateEventFilter(
(volatile INT64 *)(v14 + *(_QWORD *)(a1 + 384) + 96i64),
(INT64 *)(a5 + 48),
0);
v15 |= 0x80000400;
break;
case 0x80001000:
P = (PVOID)EtwpUpdateEventFilter((volatile INT64 *)(v14 + *(_QWORD *)(a1 + 384) + 48i64), (INT64 *)(a5 + 40), 0);
v15 |= 0x80001000;
break;
case 0x80002000:
v26 = (_ETW_FILTER_EVENT_NAME_DATA *)EtwpUpdateEventFilter(
(volatile INT64 *)(v14 + *(_QWORD *)(a1 + 384) + 56i64),
(INT64 *)(a5 + 56),
0);
v15 |= 0x80002000;
break;
case 0x80004000:
v25 = EtwpUpdateLevelKwFilter(v14 + *(_QWORD *)(a1 + 384), (INT64)&FilterData, 0, &v31);
v15 |= 0x80004000;
goto LABEL_43;
case 0x80008000:
EtwpUpdateStringFilterData((void **)(v14 + *(_QWORD *)(a1 + 384) + 40i64), (void **)(a5 + 24), 0);
v15 |= 0x80008000;
goto LABEL_43;
}
LABEL_59:
v22 = v37;
goto LABEL_60;
}
if( v8 )
{
v9 = 104i64 * (unsigned int)a2;
v10 = _InterlockedExchange((volatile __int32 *)&v8[v9], 0);
EtwpUpdateSchematizedFilterData(v9 + *(_QWORD *)(a1 + 384), 0, 0i64, a4);
if( (v10 & 0x80000004) == -2147483644 )
EtwpUpdatePidFilterData((_ETW_FILTER_HEADER *)(v9 + *(_QWORD *)(a1 + 384)), 0i64, a4);
if( (v10 & 0x80000008) == -2147483640 )
EtwpUpdateStringFilterData((void **)(v9 + *(_QWORD *)(a1 + 384) + 16i64), 0i64, a4);
if( (v10 & 0x80000010) == -2147483632 )
EtwpUpdateStringFilterData((void **)(v9 + *(_QWORD *)(a1 + 384) + 24i64), 0i64, a4);
if( (v10 & 0x80000020) == -2147483616 )
EtwpUpdateStringFilterData((void **)(v9 + *(_QWORD *)(a1 + 384) + 32i64), 0i64, a4);
if( (v10 & 0x80008000) == -2147450880 )
EtwpUpdateStringFilterData((void **)(v9 + *(_QWORD *)(a1 + 384) + 40i64), 0i64, a4);
if( (v10 & 0x80001000) == -2147479552 )
P = (PVOID)EtwpUpdateEventFilter((volatile INT64 *)(v9 + *(_QWORD *)(a1 + 384) + 48i64), 0i64, a4);
if( (v10 & 0x80000200) == -2147483136 )
updated = (PVOID)EtwpUpdateEventFilter((volatile INT64 *)(v9 + *(_QWORD *)(a1 + 384) + 72i64), 0i64, a4);
if( (v10 & 0x80000400) == -2147482624 )
v27 = (_ETW_FILTER_EVENT_NAME_DATA *)EtwpUpdateEventFilter(
(volatile INT64 *)(v9 + *(_QWORD *)(a1 + 384) + 96i64),
0i64,
a4);
if( (v10 & 0x80002000) == -2147475456 )
v26 = (_ETW_FILTER_EVENT_NAME_DATA *)EtwpUpdateEventFilter(
(volatile INT64 *)(v9 + *(_QWORD *)(a1 + 384) + 56i64),
0i64,
a4);
if( (v10 & 0x80004000) == -2147467264 )
v25 = EtwpUpdateLevelKwFilter(v9 + *(_QWORD *)(a1 + 384), 0i64, a4, &v31);
if( (v10 & 0x80000100) == -2147483392 )
v11 = (void *)EtwpUpdateEventFilter((volatile INT64 *)(v9 + *(_QWORD *)(a1 + 384) + 80i64), 0i64, a4);
else
v11 = 0i64;
goto LABEL_99;
}
return 0i64;
}Referenced by:
EtwpClearSessionAndUnreferenceEntry
EtwpUpdateGuidEnableInfo