EtwpFailLogging

VOID __fastcall EtwpFailLogging(
        UINT8 a1,
        INT64 a2,
        INT64 a3,
        INT64 a4,
        UINT8 a5,
        INT64 Status,
        EVENT_DESCRIPTOR *EventDescriptor,
        CHAR a8){
  __int64 v9; 
  UINT8 v10; 
  __int64 v13; 
  unsigned int *v14; 
  UINT8 v15; 
  bool i; 
  __int64 v17; 
  EVENT_DESCRIPTOR *v18; 
  __int64 v19; 
  __int64 v20; 
  __int64 v21; 
  INT64 v22; 
  EVENT_DESCRIPTOR *v23; 
  UNICODE_STRING *v24; 
  INT64 v25; 
  v9 = *(_QWORD *)(a3 + 392);
  v10 = a1;
  if( *(_DWORD *)(a4 + 384) )
  {
    v13 = 0i64;
    do
    {
      v14 = *(unsigned int **)(a4 + 48 * v13);
      if( (v14[3] & 0x8000000) == 0 )
      {
        **(_DWORD **)(a4 + 48 * v13 + 8) = v14[7] | **(_DWORD **)(a4 + 48 * v13 + 8) & v14[8];
        EtwpUpdateEventsLostCount((INT64)v14);
        if( EtwEventEnabled(EtwpEventTracingProvRegHandle, (EVENT_DESCRIPTOR *)&ETW_EVENT_LOST_EVENT, v18) )
          EtwpTraceLostEvent(
            (GUID *)(a3 + 40),
            EventDescriptor,
            (UNICODE_STRING *)(v14 + 38),
            (unsigned int)Status,
            v24,
            v25);
      }
      EtwpReleaseTraceBuffer((INT64 *)(a4 + 16 + 48 * v13));
      if( a8 )
        ExReleaseRundownProtectionCacheAwareEx(
          *(PEX_RUNDOWN_REF_CACHE_AWARE *)(*(_QWORD *)(v9 + 448) + 8i64 * *v14),
          1u);
      v13 = (unsigned int)(v13 + 1);
    }
    while( (unsigned int)v13 < *(_DWORD *)(a4 + 384) );
    v10 = a1;
  }
  v15 = a5;
  for( i = !_BitScanForward((unsigned int *)&v17, a5); !i; i = !_BitScanForward((unsigned int *)&v17, v15) )
  {
    v15 &= v15 - 1;
    if( EtwpLevelKeywordEnabled(a3 + 32 * (v17 + 4), v10, a2) )
    {
      v20 = *(unsigned __int16 *)(v19 + 6);
      v21 = v20;
      if( !a8
        || ExAcquireRundownProtectionCacheAwareEx(*(PEX_RUNDOWN_REF_CACHE_AWARE *)(*(_QWORD *)(v9 + 448) + 8 * v20), 1u) )
      {
        if( (unsigned int)v20 >= *(_DWORD *)(v9 + 16) )
          v22 = 1i64;
        else
          v22 = *(_QWORD *)(*(_QWORD *)(v9 + 456) + 8 * v20);
        if( (v22 & 1) == 0 )
        {
          EtwpUpdateEventsLostCount(v22);
          if( EtwEventEnabled(EtwpEventTracingProvRegHandle, (EVENT_DESCRIPTOR *)&ETW_EVENT_LOST_EVENT, v23) )
            EtwpTraceLostEvent(
              (GUID *)(a3 + 40),
              EventDescriptor,
              (UNICODE_STRING *)(v22 + 152),
              (unsigned int)Status,
              v24,
              v25);
        }
        if( a8 )
          ExReleaseRundownProtectionCacheAwareEx(*(PEX_RUNDOWN_REF_CACHE_AWARE *)(*(_QWORD *)(v9 + 448) + 8 * v21), 1u);
      }
    }
    v10 = a1;
  }
}

Referenced by: