EtwpEventWriteFull
__int64 __fastcall EtwpEventWriteFull(
__int64 a1,
unsigned __int8 a2,
char a3,
unsigned int a4,
__int64 a5,
__int16 a6,
__int16 a7,
__int64 a8,
__int64 a9,
int a10,
__int64 a11,
_ETHREAD *Thread,
__int64 a13,
__int64 a14,
__int16 a15,
__int64 a16,
__int64 a17){
_WMI_LOGGER_CONTEXT *v19;
_BYTE *v20;
unsigned __int16 v22;
__int64 v23;
_ETHREAD *v24;
_ETHREAD *v25;
char v26;
__int64 v27;
_WMI_LOGGER_CONTEXT *v28;
__int16 *v29;
__int64 v30;
bool v31;
__int64 v32;
INT64 v33;
unsigned int v34;
unsigned __int16 *v35;
char v36;
__int64 v37;
_TRACE_ENABLE_INFO *v38;
int v39;
UINT8 v40;
_EPROCESS *Process;
__int64 v42;
int v43;
__int64 v45;
__int64 v46;
unsigned __int8 v47;
__int64 LoggerId;
INT8 v49;
__int64 v50;
int v51;
_ETW_BUFFER_HANDLE *v52;
__int64 v53;
int v54;
int v55;
unsigned int v56;
int v57;
int v58;
unsigned int EnableProperty;
_ETW_SID_EXTENDED_DATA_ITEM *v60;
struct _KPRCB *CurrentPrcb;
_GENERAL_LOOKASIDE *P;
_GENERAL_LOOKASIDE *L;
unsigned int v64;
unsigned int v65;
__int64 v66;
int v67;
bool v68;
__int16 *v69;
unsigned __int8 v70;
unsigned int v71;
char v72;
bool v73;
_WMI_LOGGER_CONTEXT *v74;
unsigned int v75;
void *v76;
UINT64 *RelatedMatchId;
bool v78;
char v79;
_OWORD *v80;
__int64 v81;
__int64 v82;
__int16 v83;
int v84;
char v85;
char *v86;
INT64 v87;
int ReserveTraceBufferStatus;
int v89;
INT64 v90;
_WORD *v91;
GUID v92;
unsigned __int16 *v93;
__int64 v94;
unsigned __int16 v95;
unsigned __int16 v96;
_WORD *v97;
__int64 v98;
char *v99;
char *v100;
NTSTATUS SessionId;
NTSTATUS v102;
__int64 v103;
__int64 v104;
struct _KPRCB *v105;
unsigned __int64 v106;
__int64 v107;
VOID **PoolWithTag;
size_t v109;
char *v110;
__int16 v111;
unsigned __int16 v112;
__int64 v113;
unsigned __int16 *v114;
int v115;
__int64 v116;
unsigned __int16 *v117;
__int64 v118;
unsigned __int16 v119;
unsigned int i;
VOID *v121;
_QWORD *v122;
char v123;
char *v124;
VOID *v125;
VOID *v126;
INT64 v127;
_SLIST_ENTRY *v128;
struct _KPRCB *v129;
_GENERAL_LOOKASIDE *v130;
UINT64 CaptureKernelStack;
char v132[1512];
char v133;
unsigned __int8 CurrentIrql;
unsigned __int8 v135;
unsigned int v136;
int v137;
unsigned __int16 v138;
unsigned __int8 v139;
char v140;
int v141;
unsigned int v142;
int v143;
unsigned __int16 v144;
__int16 v145;
unsigned int v146;
int v147;
__int64 v148;
__int16 *v149;
_WMI_LOGGER_CONTEXT *LoggerContext;
unsigned __int16 *v151;
VOID *Src;
__int64 v153;
_ETWP_HEADER_EXTENDED_DATA_ITEM *StackExtendedHeaderItem;
INT64 v155;
unsigned __int16 *v156;
__int64 v157;
__int64 v158;
_ETW_SID_EXTENDED_DATA_ITEM *v159;
VOID *v160;
VOID *v161;
__int64 v162;
_ETHREAD *CurrentThread;
_LARGE_INTEGER TimeStamp;
unsigned __int64 v165;
VOID *v166;
__int64 v167;
UINT64 HighLimit;
UINT64 LowLimit;
_ETW_SILODRIVERSTATE *EtwSiloState;
__int64 *v171;
char *v172;
_ETW_BUFFER_HANDLE BufferHandle[4];
__int64 v174;
__int64 v175;
_OWORD v176[25];
_ETHREAD *Threada;
v175 = a9;
v19 = (_WMI_LOGGER_CONTEXT *)a14;
v157 = a1;
v135 = a2;
v149 = (__int16 *)a5;
v158 = a11;
v167 = a13;
v166 = (VOID *)a16;
v171 = (__int64 *)a17;
v147 = 0;
memset(v176, 0i64, 0x188u);
v142 = 0;
Src = 0i64;
v159 = 0i64;
StackExtendedHeaderItem = 0i64;
v165 = 0i64;
v145 = a15 & 0x200;
EtwSiloState = PsGetCurrentServerSiloGlobals((_KSPIN_LOCK *)0x200)->EtwSiloState;
if( (unsigned int)a10 > 0x80 )
return 3221225485i64;
if( !a14 )
v19 = (_WMI_LOGGER_CONTEXT *)a1;
LoggerContext = v19;
if( v166 )
{
if( (a15 & 0x400) != 0 )
v22 = 0;
else
v22 = *(_WORD *)v166;
}
else
{
v22 = 0;
}
v144 = v22;
v133 = 0;
v23 = *(_QWORD *)(a1 + 392);
v148 = v23;
v162 = v23;
if( v171 && *v171 )
{
v165 = *v171;
v133 = 4;
}
v24 = (_ETHREAD *)KeGetCurrentThread();
CurrentThread = v24;
v25 = Thread;
if( !Thread )
v25 = v24;
Threada = v25;
KeAreInterruptsEnabled((CHAR)v24, v20);
if( v26 )
CurrentIrql = KeGetCurrentIrql();
else
CurrentIrql = 15;
v139 = CurrentIrql;
v140 = 0;
if( !CurrentIrql )
{
--CurrentThread->Tcb.KernelApcDisable;
v140 = 1;
}
v135 &= ~a3;
v27 = 80i64;
v28 = v19;
LABEL_21:
v29 = v149;
v30 = 1i64;
LABEL_22:
while( 2 )
{
v31 = !_BitScanForward((unsigned int *)&v32, v135);
v142 = v32;
if( !v31 )
{
LOBYTE(v33) = 1;
v155 = 1i64;
*(_OWORD *)BufferHandle = 0i64;
v174 = 0i64;
TimeStamp.QuadPart = 0i64;
v34 = v27;
v137 = v27;
v35 = 0i64;
v151 = 0i64;
v156 = 0i64;
v36 = 0;
LOBYTE(v138) = 0;
LOWORD(v143) = 0;
v141 = 0;
v161 = 0i64;
v172 = 0i64;
v135 &= v135 - 1;
v37 = (unsigned int)v32;
v153 = (unsigned int)v32;
v38 = (_TRACE_ENABLE_INFO *)(&v28->DecodeControlList + 4 * v32);
if( v167 )
{
v39 = *(_DWORD *)(v167 + 4i64 * (v38->LoggerId >> 5));
v30 = 1i64;
if( _bittest(&v39, v38->LoggerId & 0x1F) )
continue;
}
v40 = EtwpLevelKeywordEnabled(v38, *((_BYTE *)v29 + 4), *((_QWORD *)v29 + 1));
v30 = 1i64;
if( !v40 )
continue;
Process = KeGetCurrentThread()->ApcState.Process;
if( ((a4 & 2) != 0 || Process->$4E3DFAFA17165B33969DFF4E60E4EB31::_bf_0 < 0)
&& (v38->EnableProperty & 0x200) != 0 )
{
continue;
}
v42 = *(_QWORD *)&v28->RealtimeLogfileName.Length;
if( v42 )
{
v43 = *(_DWORD *)(104 * v37 + v42);
if( (v43 & 0x80000200) == -2147483136 || (v43 & 0x80000100) == -2147483392 )
{
if( !EtwpApplyEventIdPayloadFilter((__int64)v28, v142, 0, (__int64)v29, *v29, a10, v158, 0, CurrentIrql) )
goto LABEL_63;
v29 = v149;
}
}
if( v145 )
{
v27 = *((_QWORD *)v29 + 1);
v45 = 0i64;
v46 = *(_QWORD *)&LoggerContext->RealtimeLogfileName.Length;
if( v46 )
{
v30 = 104 * v37;
if( (*(_DWORD *)(104 * v37 + v46) & 0x80000400) == -2147482624 )
v45 = *(_QWORD *)(v30 + v46 + 96);
if( v45 )
{
v47 = *(_BYTE *)(v45 + 1);
if( (*((_BYTE *)v29 + 4) <= v47 || !v47)
&& (!v27 || (v27 & *(_QWORD *)(v45 + 8)) != 0 && (v27 & *(_QWORD *)(v45 + 16)) == *(_QWORD *)(v45 + 16))
&& !EtwpApplyEventNameFilter(
(__int64)LoggerContext,
v142,
a10,
v158,
0,
CurrentIrql,
*((_BYTE *)v29 + 4),
*((_QWORD *)v29 + 1),
0) )
{
goto LABEL_63;
}
}
}
}
LoggerId = v38->LoggerId;
v146 = v38->LoggerId;
if( CurrentIrql >= 2u )
{
v50 = v148;
if( (unsigned int)LoggerId >= *(_DWORD *)(v148 + 16) )
{
LOBYTE(v33) = 1;
v155 = 1i64;
}
else
{
_mm_lfence();
v33 = *(_QWORD *)(*(_QWORD *)(v148 + 456) + 8 * LoggerId);
v155 = v33;
}
}
else
{
v49 = ExAcquireRundownProtectionCacheAwareEx(*(_QWORD *)(*(_QWORD *)(v148 + 448) + 8 * LoggerId), 1i64);
v50 = v148;
if( v49 )
{
if( (unsigned int)LoggerId >= *(_DWORD *)(v148 + 16) )
{
LOBYTE(v33) = 1;
v155 = 1i64;
}
else
{
_mm_lfence();
v33 = *(_QWORD *)(8 * LoggerId + *(_QWORD *)(v148 + 456));
v155 = v33;
}
v36 = 1;
LOBYTE(v138) = 1;
}
else
{
v36 = v138;
}
}
if( (v33 & 1) != 0 )
{
if( v36 )
ExReleaseRundownProtectionCacheAwareEx(*(_QWORD *)(*(_QWORD *)(v50 + 448) + 8 * LoggerId), 1i64);
v31 = (_DWORD)LoggerId == 3;
v23 = v148;
if( !v31 )
{
LABEL_63:
v28 = LoggerContext;
v27 = 80i64;
goto LABEL_21;
}
v51 = -1073741058;
if( !*(_DWORD *)(v148 + 4068) )
v51 = -1073741816;
v147 = v51;
break;
}
v54 = v175 != 0 ? 8 : 0;
v55 = 104;
if( !v175 )
v55 = 80;
v56 = v55;
v136 = v55;
if( (v38->EnableProperty & 0xFFFFFF9F) != 0 )
{
if( *(&ExBootDevicesRemovedEvent + 1520)
|| (a4 & 1) != 0
|| (MmCanThreadFault(), !v57)
|| CurrentThread->ActiveFaultCount )
{
v58 = 0;
}
else
{
v58 = 128;
}
v54 |= v58;
EnableProperty = v38->EnableProperty;
v136 = v55;
if( (EnableProperty & 0x800) != 0 )
{
if( EtwSiloState != (_ETW_SILODRIVERSTATE *)EtwpHostSiloState )
{
v54 |= 0x100u;
v56 = v55 + ((EtwSiloState->PartitionNameSize + 15) & 0xFFFFFFF8);
v136 = v56;
}
v35 = v151;
}
if( (EnableProperty & 1) != 0 && (v54 & 0x80u) != 0 )
{
v60 = (_ETW_SID_EXTENDED_DATA_ITEM *)Src;
if( Src )
goto LABEL_100;
CurrentPrcb = KeGetCurrentPrcb();
P = CurrentPrcb->PPLookasideList[8].P;
++P->TotalAllocates;
v60 = (_ETW_SID_EXTENDED_DATA_ITEM *)RtlpInterlockedPopEntrySList(&P->ListHead);
Src = v60;
if( !v60 )
{
++P->AllocateMisses;
L = CurrentPrcb->PPLookasideList[8].L;
++L->TotalAllocates;
v60 = (_ETW_SID_EXTENDED_DATA_ITEM *)RtlpInterlockedPopEntrySList(&L->ListHead);
Src = v60;
if( !v60 )
{
++L->AllocateMisses;
v60 = (_ETW_SID_EXTENDED_DATA_ITEM *)((__int64(__fastcall *)(_QWORD, _QWORD, _QWORD))L->AllocateEx)(
(unsigned int)L->Type,
L->Size,
L->Tag);
Src = v60;
}
}
if( v60 )
*(_DWORD *)&v60->Header.Size = CurrentPrcb->Number;
v159 = v60;
if( v60 )
{
EtwpGetSidExtendedHeaderItem(v60);
v60 = (_ETW_SID_EXTENDED_DATA_ITEM *)Src;
}
v37 = v153;
if( v60 )
{
LABEL_100:
v54 |= 2u;
v56 += v60->Header.Size;
v136 = v56;
}
}
v64 = v38->EnableProperty;
if( (v64 & 2) != 0 )
{
v54 |= 1u;
v56 += 16;
v136 = v56;
}
if( (v64 & 0x80u) != 0 && (ObGetCurrentIrql() < 2u || !KeGetCurrentPrcb()->NestingLevel) )
{
v54 |= 0x20u;
v56 += 16;
v136 = v56;
}
v65 = v38->EnableProperty;
if( (v65 & 0x100) != 0 )
{
v54 |= 0x40u;
v56 += 16;
v136 = v56;
}
if( (v65 & 4) != 0 && !*(&ExBootDevicesRemovedEvent + 1520) )
{
v66 = *(_QWORD *)&LoggerContext->RealtimeLogfileName.Length;
v68 = 0;
if( v66 )
{
v67 = *(_DWORD *)(104 * v37 + v66);
if( (v67 & 0x80001000) == -2147479552
|| (v67 & 0x80002000) == -2147475456
|| (v67 & 0x80004000) == -2147467264 )
{
v68 = 1;
}
}
v69 = v149;
if( !v68
|| (v70 = v139, v132[1504] = v139 < 2u, v71 = v142, EtwpApplyLevelKwFilter(LoggerContext), v72)
&& (v73 = v70 < 2u, v74 = LoggerContext, EtwpApplyStackWalkIdFilter(*v69, (INT64)LoggerContext, v71, v73))
&& EtwpApplyEventNameFilter(
(__int64)v74,
v71,
a10,
v158,
0,
CurrentIrql,
*((_BYTE *)v69 + 4),
*((_QWORD *)v69 + 1),
1) )
{
if( (v133 & 1) == 0 )
{
v75 = 256;
StackExtendedHeaderItem = (_ETWP_HEADER_EXTENDED_DATA_ITEM *)EtwpGetStackLookasideListEntry();
if( !StackExtendedHeaderItem )
{
HighLimit = 0i64;
LowLimit = 0i64;
IoGetStackLimits(&LowLimit, &HighLimit);
if( (unsigned __int64)&HighLimit - LowLimit > 0x1440 )
{
v76 = alloca(1552i64);
StackExtendedHeaderItem = (_ETWP_HEADER_EXTENDED_DATA_ITEM *)v132;
v75 = 192;
}
}
if( StackExtendedHeaderItem )
{
RelatedMatchId = 0i64;
v78 = (*(_DWORD *)(v155 + 832) & 0x40000000) == 0;
if( *(_OWORD *)(v157 + 40) == *(_OWORD *)&EventTracingProvGuid && *v69 == 18 )
{
v54 |= 0x10u;
RelatedMatchId = (UINT64 *)(v157 + 80);
v78 = 0;
}
EtwpGetStackExtendedHeaderItem(CurrentThread, a4, v75, &StackExtendedHeaderItem, v78, RelatedMatchId);
if( StackExtendedHeaderItem && v75 == 256 )
v79 = 2;
else
v79 = 0;
v133 = v79 | v133 & 0xFD;
}
v133 |= 1u;
}
if( StackExtendedHeaderItem )
{
v54 |= 4u;
v56 += StackExtendedHeaderItem->Size;
v136 = v56;
}
}
}
}
v80 = &v176[3 * LODWORD(v176[24])];
v153 = (__int64)v80;
if( a10 )
{
v81 = v158 + 8;
v82 = (unsigned int)a10;
v83 = v143;
v84 = v141;
do
{
if( v145 )
v85 = *(_BYTE *)(v81 + 4);
else
v85 = 0;
if( v85 )
{
if( v85 == 1 )
{
v83 += *(_WORD *)v81;
LOWORD(v143) = v83;
v141 = ++v84;
}
}
else
{
v56 += *(_DWORD *)v81;
v136 = v56;
}
v81 += 16i64;
--v82;
}
while( v82 );
v35 = v151;
v80 = (_OWORD *)v153;
}
if( v141 )
{
v56 += ((unsigned __int16)v143 + 15) & 0xFFFFFFF8;
v136 = v56;
}
if( v144 )
{
v56 += (v144 + 15) & 0xFFFFFFF8;
v136 = v56;
}
*((_DWORD *)v80 + 10) = v56;
LODWORD(CaptureKernelStack) = 0;
v86 = (char *)EtwpReserveTraceBuffer(
(_WMI_LOGGER_CONTEXT *)v155,
v56,
BufferHandle,
&TimeStamp,
CaptureKernelStack);
v153 = (__int64)v86;
if( !v86 )
{
v87 = v155;
ReserveTraceBufferStatus = EtwpGetReserveTraceBufferStatus((_WMI_LOGGER_CONTEXT *)v155, v56);
if( EtwEventEnabled(*(&ExBootDevicesRemovedEvent + 241), &ETW_EVENT_LOST_EVENT) )
EtwpTraceLostEvent((_QWORD *)(v157 + 40), v149, (unsigned __int16 *)(v87 + 152), ReserveTraceBufferStatus);
v89 = v147;
if( v147 >= 0 )
{
if( (*(_DWORD *)(v87 + 12) & 0x8000000) == 0 )
v89 = ReserveTraceBufferStatus;
v147 = v89;
}
v23 = v148;
if( (_BYTE)v138 )
ExReleaseRundownProtectionCacheAwareEx(*(_QWORD *)(*(_QWORD *)(v148 + 448) + 8i64 * v146), 1i64);
v28 = LoggerContext;
v27 = 80i64;
if( ReserveTraceBufferStatus == -1073741675 )
{
v147 = -1073741675;
break;
}
goto LABEL_21;
}
v90 = v155;
*(_QWORD *)v80 = v155;
*((_QWORD *)v80 + 1) = v86;
v80[1] = *(_OWORD *)BufferHandle;
*((_QWORD *)v80 + 4) = v174;
++LODWORD(v176[24]);
*(_DWORD *)v86 = v56 | *(_DWORD *)(v90 + 20);
v91 = v86 + 4;
v160 = v86 + 4;
*((_WORD *)v86 + 2) = a6;
*((_WORD *)v86 + 3) = a7;
*(_OWORD *)(v86 + 24) = *(_OWORD *)(v157 + 40);
*(_OWORD *)(v86 + 40) = *(_OWORD *)v149;
if( a8 )
v92 = *(GUID *)a8;
else
v92 = NullGuid;
*((GUID *)v86 + 4) = v92;
*((_LARGE_INTEGER *)v86 + 2) = TimeStamp;
*((_DWORD *)v86 + 2) = Threada->Cid.UniqueThread;
*((_DWORD *)v86 + 3) = Threada->Cid.UniqueProcess;
*((_DWORD *)v86 + 14) = Threada->Tcb.SchedulerApc.SpareLong0;
*((_DWORD *)v86 + 15) = Threada->Tcb.UserTime;
if( !v54 )
goto LABEL_206;
if( (v54 & 0x100) != 0 )
{
v93 = (unsigned __int16 *)(v86 + 80);
v151 = v93;
v94 = (__int64)EtwSiloState;
v95 = (EtwSiloState->PartitionNameSize + 15) & 0xFFF8;
*v93 = v95;
v93[1] = 16;
v93[3] = *(_WORD *)(v94 + 4200);
v93[2] = 0;
v96 = v95 - *(_WORD *)(v94 + 4200) - 8;
v97 = v93 + 4;
memmove(v93 + 4, *(const VOID **)(v94 + 4192), *(unsigned __int16 *)(v94 + 4200));
memset((char *)v97 + *(unsigned __int16 *)(v94 + 4200), 0i64, v96);
*v91 |= 1u;
v35 = v151;
v34 = *v151 + 80;
v137 = v34;
v156 = v151;
v86 = (char *)v153;
}
if( (v54 & 8) != 0 )
{
v98 = (__int64)&v86[v34];
*(_DWORD *)v98 = 65560;
*(_DWORD *)(v98 + 4) = 0x100000;
*(_OWORD *)(v98 + 8) = *(_OWORD *)a9;
*v91 |= 1u;
v34 += 24;
v137 = v34;
if( v35 )
v35[2] |= 1u;
v35 = (unsigned __int16 *)v98;
v151 = (unsigned __int16 *)v98;
v156 = (unsigned __int16 *)v98;
}
if( (v54 & 2) != 0 )
{
v99 = &v86[v34];
memmove(v99, Src, *(unsigned __int16 *)Src);
*v91 |= 1u;
v34 += *(unsigned __int16 *)Src;
v137 = v34;
if( v35 )
v35[2] |= 1u;
v35 = (unsigned __int16 *)v99;
v151 = (unsigned __int16 *)v99;
v156 = (unsigned __int16 *)v99;
}
if( (v54 & 1) != 0 )
{
v100 = &v86[v34];
*(_DWORD *)v100 = 196624;
*((_DWORD *)v100 + 1) = 0x40000;
SessionId = MmGetSessionIdEx(KeGetCurrentThread()->ApcState.Process);
v102 = 0;
if( SessionId != -1 )
v102 = SessionId;
*((_DWORD *)v100 + 2) = v102;
*v91 |= 1u;
v34 += 16;
v137 = v34;
if( v35 )
v35[2] |= 1u;
v35 = (unsigned __int16 *)v100;
v151 = (unsigned __int16 *)v100;
v156 = (unsigned __int16 *)v100;
}
if( (v54 & 0x20) != 0 )
{
v103 = (__int64)&v86[v34];
*(_DWORD *)v103 = 851984;
*(_DWORD *)(v103 + 4) = 0x80000;
*(_QWORD *)(v103 + 8) = KeGetCurrentThread()->ApcState.Process->SequenceNumber | ((unsigned __int64)KUSER_SHARED_DATA.BootId << 48);
*v91 |= 1u;
v34 += 16;
v137 = v34;
if( v35 )
v35[2] |= 1u;
v35 = (unsigned __int16 *)v103;
v151 = (unsigned __int16 *)v103;
v156 = (unsigned __int16 *)v103;
}
if( (v54 & 0x40) != 0 )
{
v104 = (__int64)&v86[v34];
*(_DWORD *)v104 = 655376;
*(_DWORD *)(v104 + 4) = 0x80000;
if( (v133 & 4) != 0 )
{
v106 = v165;
}
else
{
v105 = KeGetCurrentPrcb();
v106 = _InterlockedIncrement64((volatile signed __int64 *)v105->EtwSupport + 1) & 0xFFFFFFFFFFFFi64 | ((unsigned __int64)v105->Number << 48);
v165 = v106;
v133 |= 4u;
if( v171 )
*v171 = v106;
}
*(_QWORD *)(v104 + 8) = v106;
*v91 |= 1u;
v34 += 16;
v137 = v34;
if( v35 )
v35[2] |= 1u;
v35 = (unsigned __int16 *)v104;
v151 = (unsigned __int16 *)v104;
v156 = (unsigned __int16 *)v104;
}
if( (v54 & 4) == 0 )
goto LABEL_206;
v107 = (__int64)&v86[v34];
memmove((VOID *)v107, StackExtendedHeaderItem, StackExtendedHeaderItem->Size);
if( *(_QWORD *)(v107 + 8) && (v54 & 0x10) == 0 )
{
if( v148 != EtwpHostSiloState )
goto LABEL_202;
PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x58ui64, 1098347589i64);
if( !PoolWithTag )
goto LABEL_202;
KeInitializeApc(
(INT64)PoolWithTag,
(INT64)Threada,
0i64,
(INT64)EtwpCrimsonStackWalkApc,
0i64,
(INT64)EtwpCrimsonStackWalkApc,
0,
v146);
if( !KeInsertQueueApc((INT64)PoolWithTag, *(unsigned int *)(v107 + 8), *(unsigned int *)(v107 + 12), 0i64) )
{
ExFreePoolWithTag(PoolWithTag, 0);
LABEL_202:
*(_QWORD *)(v107 + 8) = 0i64;
}
}
*v91 |= 1u;
v34 += StackExtendedHeaderItem->Size;
v137 = v34;
if( v35 )
v35[2] |= 1u;
v35 = (unsigned __int16 *)v107;
v151 = (unsigned __int16 *)v107;
v156 = (unsigned __int16 *)v107;
LABEL_206:
v109 = v144;
if( v144 )
{
v110 = &v86[v34];
TimeStamp.QuadPart = (LONGLONG)v110;
v111 = (v144 + 15) & 0xFFF8;
*(_WORD *)v110 = v111;
*(_DWORD *)(v110 + 2) = 12;
*((_WORD *)v110 + 3) = v109;
v112 = v111 - v109 - 8;
v138 = v112;
v113 = v109;
memmove(v110 + 8, v166, v109);
memset(&v110[v113 + 8], 0i64, v112);
v114 = v151;
*v91 |= 1u;
v34 += *(unsigned __int16 *)v110;
v137 = v34;
if( v114 )
v114[2] |= 1u;
v35 = (unsigned __int16 *)v110;
}
v115 = v141;
v116 = v153;
if( v141 )
{
v117 = (unsigned __int16 *)(v153 + v34);
v118 = (unsigned __int16)v143;
v119 = (v143 + 15) & 0xFFF8;
*v117 = v119;
*(_DWORD *)(v117 + 1) = 11;
v117[3] = v118;
v161 = v117 + 4;
v172 = (char *)v117 + v118 + 8;
memset(v172, 0i64, (unsigned __int16)(v119 - v118 - 8));
*v91 |= 1u;
v34 += *v117;
v137 = v34;
v115 = v141;
if( v35 )
v35[2] |= 1u;
}
for( i = 0; ; ++i )
{
while( 1 )
{
v142 = i;
if( i >= a10 )
{
v127 = v155;
if( (*(_DWORD *)(v155 + 12) & 0x80000) != 0
&& (!(_BYTE)KdDebuggerNotPresent && !KdPitchDebugger || KdEventLoggingPresent) )
{
EtwpSendTraceEvent((_WMI_LOGGER_CONTEXT *)v155, BufferHandle);
}
if( *(_QWORD *)(v127 + 1272) )
EtwpInvokeEventCallback(v127, (INT64)BufferHandle, v157 + 40);
v29 = v149;
v23 = v148;
v28 = LoggerContext;
v30 = 1i64;
v27 = 80i64;
if( v167 )
*(_DWORD *)(v167 + 4i64 * (v146 >> 5)) |= 1 << (v146 & 0x1F);
goto LABEL_22;
}
v121 = (VOID *)*(unsigned int *)(v158 + 16i64 * i + 8);
v143 = *(_DWORD *)(v158 + 16i64 * i + 8);
v122 = *(_QWORD **)(v158 + 16i64 * i);
v123 = v145 ? *(_BYTE *)(v158 + 16i64 * i + 12) : 0;
if( v123 )
break;
v126 = (VOID *)(v116 + v34);
v160 = v126;
v34 += (unsigned int)v121;
v137 = v34;
if( v34 > v56 )
KeBugCheckEx(0x11Du, (PVOID)5, (PVOID)v34, (PVOID)v56, 0i64);
memmove(v126, v122, (size_t)v121);
v115 = v141;
LABEL_229:
++i;
}
if( v123 != 1 )
{
if( v123 == 3 && (_DWORD)v121 == 8 )
*(_QWORD *)(v116 + 16) = *v122;
goto LABEL_229;
}
v124 = (char *)v161;
if( !v161 || (v125 = v121, v160 = v121, (char *)v161 + (unsigned __int64)v121 > v172) || !v115 )
KeBugCheckEx(0x11Du, (PVOID)5, (PVOID)v34, (PVOID)v56, 0i64);
memmove(v161, v122, (size_t)v121);
v161 = &v124[(_QWORD)v125];
v115 = --v141;
}
}
break;
}
if( (v133 & 2) != 0 )
RtlpInterlockedPushEntrySList(&xmmword_140C53A90, (PSLIST_ENTRY)&StackExtendedHeaderItem[-2]);
if( v147 < 0 )
{
EtwpFailLogging(*((_BYTE *)v149 + 4), *((_QWORD *)v149 + 1), v157, (__int64)v176, v135, v147, v149, v139 < 2u);
}
else if( LODWORD(v176[24]) )
{
v52 = (_ETW_BUFFER_HANDLE *)v176;
v53 = LODWORD(v176[24]);
do
{
EtwpReleaseTraceBuffer(v52 + 4);
if( CurrentIrql < 2u )
ExReleaseRundownProtectionCacheAwareEx(
*(_QWORD *)(*(_QWORD *)(v23 + 448) + 8i64 * **(unsigned int **)v52),
1i64);
v52 += 12;
--v53;
}
while( v53 );
}
if( v140 )
KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
v128 = (_SLIST_ENTRY *)Src;
if( Src )
{
v129 = KeGetCurrentPrcb();
v130 = v129->PPLookasideList[8].P;
++v130->TotalFrees;
if( LOWORD(v130->ListHead.Alignment) < v130->Depth
|| (++v130->FreeMisses,
v130 = v129->PPLookasideList[8].L,
++v130->TotalFrees,
LOWORD(v130->ListHead.Alignment) < v130->Depth) )
{
RtlpInterlockedPushEntrySList(&v130->ListHead, v128);
}
else
{
++v130->FreeMisses;
((void(__fastcall *)(_SLIST_ENTRY *, struct _KPRCB *, __int64, __int64))v130->FreeEx)(v128, v129, v30, v27);
}
}
return(unsigned int)v147;
}Referenced by:
EtwWriteErrorLogEntry
EtwWriteEx
EtwWriteKMSecurityEvent
EtwWriteString
EtwpCrimsonStackWalkApc
EtwpDiskProvTraceDisk