EtwTraceObject

VOID __stdcall EtwTraceObject(UINT16 HookId, _OBJECT_HEADER *ObjectHeader){
  unsigned __int8 v4; 
  unsigned int v5; 
  unsigned int v6; 
  unsigned int v7; 
  bool v8; 
  __int64 v9; 
  __int64 v10; 
  int v11; 
  _WORD *v12; 
  int v13; 
  unsigned int v14; 
  __int128 v15; 
  __int64 v16[2]; 

  v4 = ObHeaderCookie ^ ObjectHeader->TypeIndex ^ BYTE1(ObjectHeader);
  v5 = 0;
  v15 = 0i64;
  v6 = *(_DWORD *)(ObTypeIndexTable[v4] + 192);
  v14 = v6;
  v7 = *(_DWORD *)(EtwpHostSiloState + 4224);
  v8 = !_BitScanForward((unsigned int *)&v9, v7);
  if( !v8 )
  {
    do
    {
      v7 &= v7 - 1;
      v10 = 32i64 * (unsigned int)v9 + EtwpHostSiloState + 4260;
      if( v10 )
      {
        if( (*(_DWORD *)(v10 + 16) & 0x80u) != 0 )
        {
          v11 = 0;
          v12 = (_WORD *)(0x140000000i64 + 20 * v9 + 12687392);
          if( *v12 )
          {
            while( 1 )
            {
              v13 = ExCheckSingleFilter(v6, *(unsigned int *)&v12[2 * v11 + 2]);
              v6 = v14;
              if( v13 )
                break;
              if( ++v11 >= (unsigned int)(unsigned __int16)*v12 )
                goto LABEL_9;
            }
            v5 |= 1 << v9;
          }
        }
      }
LABEL_9:
      v8 = !_BitScanForward((unsigned int *)&v9, v7);
    }
    while( !v8 );
    if( v5 )
    {
      v16[1] = 16i64;
      *(_QWORD *)&v15 = &ObjectHeader->Body;
      WORD4(v15) = v4;
      v16[0] = (__int64)&v15;
      EtwpTraceKernelEventWithFilter((__int64)v16, 1u, v5, HookId, 273684738);
    }
  }
}

Referenced by: