EtwpTraceFileName

VOID __stdcall EtwpTraceFileName(PVOID FileKey, UNICODE_STRING *FileName, UINT64 LoggerId, UINT16 HookId){
  __int64 v4; 
  INT64 ThreadServerSilo; 
  unsigned int v8; 
  INT64 *v9; 
  UINT64 v10; 
  LPCGUID ActivityId; 
  LPCGUID RelatedActivityId; 
  UINT64 UserDataCount; 
  __int16 v14; 
  __int64 v15[2]; 
  EVENT_DATA_DESCRIPTOR a2; 
  __int64 v17; 
  unsigned int v18; 
  int v19; 
  __int16 *v20; 
  __int64 v21; 
  unsigned int DataCount; 
  INT16 v23; 
  v4 = HookId;
  v15[1] = 0i64;
  v14 = 0;
  if( FileKey )
  {
    ThreadServerSilo = *((_QWORD *)FileKey + 270);
  }
  else if( KeIsExecutingInArbitraryThreadContext() )
  {
    ThreadServerSilo = 0i64;
  }
  else
  {
    ThreadServerSilo = PsGetThreadServerSilo((INT64)KeGetCurrentThread());
  }
  v8 = *(unsigned __int16 *)LoggerId;
  v15[0] = (__int64)FileName;
  if( v8 > 0x2000 )
    v8 = 0x2000;
  *(_QWORD *)&a2.Size = 8i64;
  v18 = v8;
  a2.Ptr = (unsigned __int64)v15;
  v17 = *(_QWORD *)(LoggerId + 8);
  v20 = &v14;
  v19 = 0;
  v21 = 2i64;
  if( EtwpHostSiloState != -4516 && (*(_DWORD *)(EtwpHostSiloState + 4516) & 0x200) != 0 )
  {
    if( v23 == 1056 )
    {
      LODWORD(UserDataCount) = 3;
      EtwWriteEx(
        EtwpFileProvRegHandle,
        (EVENT_DESCRIPTOR *)&KFileEvt_NameCreate,
        0i64,
        0i64,
        0i64,
        0i64,
        UserDataCount,
        &a2);
LABEL_12:
      LODWORD(RelatedActivityId) = 4200450;
      EtwTraceSiloKernelEvent(ThreadServerSilo, &a2, 3u, 0x200ui64, v23, (INT64)RelatedActivityId);
      return;
    }
    if( v23 == 1059 )
    {
      LODWORD(UserDataCount) = 3;
      EtwWriteEx(
        EtwpFileProvRegHandle,
        (EVENT_DESCRIPTOR *)KFileEvt_NameDelete,
        0i64,
        0i64,
        0i64,
        0i64,
        UserDataCount,
        &a2);
    }
  }
  if( v23 != 1060 )
    goto LABEL_12;
  if( v4 )
  {
    if( v4 != ThreadServerSilo )
      return;
    v9 = *(INT64 **)(v4 + 1272);
  }
  else
  {
    v9 = &PspHostSiloGlobals;
  }
  v10 = v9[108];
  if( v10 )
  {
    LODWORD(RelatedActivityId) = 4200450;
    LOWORD(ActivityId) = 1060;
    EtwpLogKernelEvent(&a2, v10, DataCount, 3u, (UINT64)ActivityId, (UINT64)RelatedActivityId);
  }
}

Referenced by: