EtwpGetAutoLoggerEventNameFilter
VOID __fastcall EtwpGetAutoLoggerEventNameFilter(UINT64 a1, INT64 a2, INT64 a3, PVOID *a4, _DWORD *a5){
__int64 v6;
__int64 v7;
WCHAR *v10;
__int64 v11;
UINT64 v12;
WCHAR *PoolWithTag;
WCHAR *v14;
int v15;
WCHAR v16;
void *v17;
__int64 v18;
UINT64 v19;
WCHAR *v20;
WCHAR v21;
HANDLE v22;
void *v23;
__int64 v24;
int v25;
_KEXCEPTION_FRAME *v26;
__int64 v27;
char *v28;
char *v29;
unsigned __int16 v30;
unsigned int v31;
CHAR *v32;
UINT64 UnicodeStringByteCount;
__int16 v34;
void *KeyHandle;
HANDLE Handle;
ULONG UTF8StringActualByteCount[2];
struct _UNICODE_STRING UnicodeString;
struct _UNICODE_STRING DestinationString;
struct _OBJECT_ATTRIBUTES ObjectAttributes;
INT64 v41;
int v42;
__int64 v43;
int v44;
__int64 v45;
int v46;
__int64 v47;
int v48;
__int64 v49;
int v50;
__int64 v51;
int v52;
struct _UNICODE_STRING *p_UnicodeString;
INT64 result[4];
int v55;
char *v56;
INT64(__stdcall *v57)(WCHAR *, UINT64, PVOID, UINT64, PVOID, PVOID);
const wchar_t *v58;
int *v59;
int v60;
char *v61;
INT64(__stdcall *v62)(WCHAR *, UINT64, PVOID, UINT64, PVOID, PVOID);
const WCHAR *v63;
int *v64;
int v65;
char *v66;
INT64(__stdcall *v67)(WCHAR *, UINT64, PVOID, UINT64, PVOID, PVOID);
const wchar_t *v68;
int *v69;
int v70;
char v71;
INT64(__stdcall *v72)(WCHAR *, UINT64, PVOID, UINT64, PVOID, PVOID);
const wchar_t *v73;
int *v74;
int v75;
INT64(__stdcall *v76)(WCHAR *, UINT64, PVOID, UINT64, PVOID, PVOID);
const wchar_t *v77;
int *v78;
int v79;
wchar_t *Buffer;
int Length;
v41 = a2;
*(_QWORD *)UTF8StringActualByteCount = a1;
v6 = -1i64;
*a4 = 0i64;
*a5 = 0;
v7 = -1i64;
KeyHandle = 0i64;
Handle = 0i64;
memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
v34 = 0;
v10 = 0i64;
DestinationString = 0i64;
UnicodeString = 0i64;
do
++v7;
while( *(_WORD *)(a3 + 2 * v7) );
v11 = -1i64;
do
++v11;
while( *(_WORD *)(a1 + 2 * v11) );
v12 = (unsigned int)(2 * (v11 + v7) + 4);
PoolWithTag = (WCHAR *)ExAllocatePoolWithTag(PagedPool, v12, 0x50777445ui64);
v14 = PoolWithTag;
if( PoolWithTag )
{
HIDWORD(UnicodeStringByteCount) = HIDWORD(a3);
v15 = RtlStringCbPrintfW(PoolWithTag, (unsigned int)v12, (WCHAR *)L"%ws\\%ws");
if( v15 )
goto LABEL_12;
RtlInitUnicodeString(&DestinationString, v14, v16);
ObjectAttributes.Length = 48;
ObjectAttributes.ObjectName = &DestinationString;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v15 = ZwOpenKey(&KeyHandle, 0x20019u, &ObjectAttributes);
v17 = KeyHandle;
if( v15 < 0 )
v17 = 0i64;
KeyHandle = v17;
if( v41 )
{
v18 = -1i64;
do
++v18;
while( *(_WORD *)(a3 + 2 * v18) );
do
++v6;
while( *(_WORD *)(v41 + 2 * v6) );
v19 = (unsigned int)(2 * (v6 + v18) + 4);
v20 = (WCHAR *)ExAllocatePoolWithTag(PagedPool, v19, 0x50777445ui64);
v10 = v20;
if( !v20 )
goto LABEL_13;
HIDWORD(UnicodeStringByteCount) = HIDWORD(a3);
v15 = RtlStringCbPrintfW(v20, (unsigned int)v19, (WCHAR *)L"%ws\\%ws");
if( v15 )
goto LABEL_12;
RtlInitUnicodeString(&DestinationString, v10, v21);
ObjectAttributes.Length = 48;
ObjectAttributes.ObjectName = &DestinationString;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v15 = ZwOpenKey(&Handle, 0x20019u, &ObjectAttributes);
v22 = Handle;
if( v15 < 0 )
v22 = 0i64;
Handle = v22;
}
if( !KeyHandle && !Handle )
goto LABEL_12;
*a5 = 4096;
v23 = ExAllocatePoolWithTag(PagedPool, 0x1000ui64, 0x50777445ui64);
*a4 = v23;
v24 = (__int64)v23;
if( v23 )
{
memset((INT64)result, 0i64);
v43 = v24;
result[0] = (INT64)EtwpQueryRegistryCallback;
v55 = 11;
result[3] = (INT64)&v42;
v42 = 11;
result[2] = (INT64)L"MatchAnyKeyword";
v60 = 11;
v59 = &v44;
v58 = L"MatchAllKeyword";
v45 = v24 + 8;
v64 = &v46;
v63 = L"Level";
v47 = v24 + 16;
v69 = &v48;
v68 = L"FilterIn";
v49 = v24 + 17;
v74 = &v50;
v73 = L"NameCount";
v51 = v24 + 18;
v44 = 11;
v78 = &v52;
v57 = EtwpQueryRegistryCallback;
v77 = L"Names";
Buffer = (wchar_t *)&v34;
v62 = EtwpQueryRegistryCallback;
v65 = 4;
v46 = 4;
v67 = EtwpQueryRegistryCallback;
v70 = 4;
v48 = 4;
v72 = EtwpQueryRegistryCallback;
v75 = 4;
v50 = 4;
v76 = EtwpQueryRegistryCallback;
p_UnicodeString = &UnicodeString;
v79 = 1;
v52 = 1;
LOBYTE(v25) = RtlpQueryRegistryValues((_KTRAP_FRAME *)0x40000000, (_KEXCEPTION_FRAME *)KeyHandle);
if( v25 >= 0 )
{
v26 = (_KEXCEPTION_FRAME *)Handle;
if( Handle )
{
v27 = 2i64;
v56 = (char *)*a4;
v61 = v56 + 8;
v66 = v56 + 16;
v28 = v56 + 17;
v29 = &v71;
do
{
*(_QWORD *)v29 = v28++;
v29 += 56;
--v27;
}
while( v27 );
Buffer = UnicodeString.Buffer;
Length = UnicodeString.Length;
RtlpQueryRegistryValues((_KTRAP_FRAME *)0x40000000, v26);
}
v30 = UnicodeString.Length;
v31 = 0;
if( (UnicodeString.Length & 0xFFFE) != 0 )
{
do
{
if( UnicodeString.Buffer[v31] == 59 )
{
UnicodeString.Buffer[v31] = 0;
v30 = UnicodeString.Length;
}
++v31;
}
while( v31 < v30 >> 1 );
}
v32 = (char *)*a4 + 20;
UTF8StringActualByteCount[0] = *a5 - 20;
LODWORD(UnicodeStringByteCount) = v30 + 2;
v15 = RtlUnicodeToUTF8N(
v32,
UTF8StringActualByteCount[0],
(UINT64 *)UTF8StringActualByteCount,
UnicodeString.Buffer,
UnicodeStringByteCount);
if( !v15 )
*a5 = UTF8StringActualByteCount[0] + 20;
LABEL_12:
if( v15 >= 0 )
goto LABEL_15;
}
}
}
LABEL_13:
*a5 = 0;
if( *a4 )
{
ExFreePoolWithTag(*a4, 0);
*a4 = 0i64;
}
LABEL_15:
if( KeyHandle )
ZwClose(KeyHandle);
if( v14 )
ExFreePoolWithTag(v14, 0);
if( Handle )
ZwClose(Handle);
if( v10 )
ExFreePoolWithTag(v10, 0);
RtlFreeAnsiString(&UnicodeString);
}Referenced by:
EtwpGetAutoLoggerProviderFilter