EtwTraceRaw

NTSTATUS __stdcall EtwTraceRaw(UINT64 TraceHandle, VOID *Data, UINT64 DataSize, INT8 RequestorMode){
  __int64 v5; 
  int ReserveTraceBufferStatus; 
  unsigned int v7; 
  _ETW_SILODRIVERSTATE *EtwSiloState; 
  _WMI_LOGGER_CONTEXT *v9; 
  _WMI_LOGGER_CONTEXT *v10; 
  VOID *v11; 
  UINT64 v13; 
  _LARGE_INTEGER TimeStamp; 
  _WMI_LOGGER_CONTEXT *v15; 
  _ETW_BUFFER_HANDLE BufferHandle[4]; 
  __int64 v17; 
  _ETW_LOGGER_HANDLE LoggerHandle; 
  VOID *Src; 
  INT8 v20; 

  v20 = RequestorMode;
  Src = Data;
  v5 = (unsigned int)DataSize;
  *(_OWORD *)BufferHandle = 0i64;
  v17 = 0i64;
  LoggerHandle.DereferenceAndLeave = 0;
  ReserveTraceBufferStatus = 0;
  TimeStamp.QuadPart = 0i64;
  v7 = (unsigned __int16)TraceHandle;
  if( RequestorMode )
    EtwSiloState = PsGetCurrentServerSiloGlobals((_KSPIN_LOCK *)TraceHandle)->EtwSiloState;
  else
    EtwSiloState = (_ETW_SILODRIVERSTATE *)EtwpHostSiloState;
  if( v7 < EtwSiloState->MaxLoggers )
  {
    v9 = EtwpOpenLogger(v7, EtwSiloState, RequestorMode, &LoggerHandle);
    v10 = v9;
    v15 = v9;
    if( v9 )
    {
      if( (v9->LoggerMode & 0x80u) != 0 )
      {
        ReserveTraceBufferStatus = -1073741790;
LABEL_31:
        EtwpCloseLogger(v7, EtwSiloState, LoggerHandle);
        return ReserveTraceBufferStatus;
      }
      if( RequestorMode )
      {
        ReserveTraceBufferStatus = EtwpCheckLoggerControlAccess(0x200ui64, v9);
        if( ReserveTraceBufferStatus < 0 )
          goto LABEL_31;
        if( (_DWORD)v5 )
        {
          if( ((unsigned __int8)Src & 3) != 0 )
            ExRaiseDatatypeMisalignment();
          if( (unsigned __int64)Src + v5 > 0x7FFFFFFF0000i64 || (char *)Src + v5 < Src )
            MEMORY[0x7FFFFFFF0000] = 0;
        }
      }
      else if( (v9->LoggerMode & 0x1000000) != 0 )
      {
        ReserveTraceBufferStatus = -1073741637;
        goto LABEL_31;
      }
      LODWORD(v13) = 0;
      v11 = EtwpReserveTraceBuffer(v10, (unsigned int)v5, BufferHandle, &TimeStamp, v13);
      if( v11 )
      {
        memmove(v11, Src, v5);
        if( (v10->LoggerMode & 0x80000) != 0
          && (!(_BYTE)KdDebuggerNotPresent && !KdPitchDebugger || KdEventLoggingPresent) )
        {
          EtwpSendTraceEvent(v10, BufferHandle);
        }
        if( v10->CallbackContext )
          EtwpInvokeEventCallback((INT64)v10, (INT64)BufferHandle, 0i64);
        EtwpReleaseTraceBuffer(BufferHandle);
      }
      else
      {
        ReserveTraceBufferStatus = EtwpGetReserveTraceBufferStatus(v10, (unsigned int)v5);
      }
      goto LABEL_31;
    }
  }
  return -1073741816;
}

Referenced by: