EtwpGetLoggerInfoFromContext

NTSTATUS __stdcall EtwpGetLoggerInfoFromContext(
        _WMI_LOGGER_INFORMATION *LoggerInfo,
        _WMI_LOGGER_CONTEXT *LoggerContext){
  unsigned int BuffersWritten; 
  __int64 v5; 
  __int16 LoggerId; 
  _ETHREAD *LoggerThread; 
  char PreviousMode; 
  __int64 Length; 
  char v10; 
  __int64 v11; 
  __int64 v13; 
  _ETW_SILODRIVERSTATE *SiloState; 
  PERFINFO_GROUPMASK GroupMask[4]; 
  __int128 v16; 

  if( (LoggerContext->LoggerMode & 0x2000000) != 0 )
  {
    v13 = BYTE2(LoggerContext->$B4A554AA980A5EA7570A49F99BAE17BC::_bf_0);
    SiloState = LoggerContext->SiloState;
    *(_OWORD *)GroupMask = *(_OWORD *)SiloState->SystemLoggerSettings.EtwpGroupMasks[v13].Masks;
    v16 = *(_OWORD *)&SiloState->SystemLoggerSettings.EtwpGroupMasks[v13].Masks[4];
    EtwpMapEnableFlags(GroupMask, 0);
    LoggerInfo[18] = GroupMask[0];
  }
  else
  {
    LoggerInfo[18] = 0;
  }
  *(_GUID *)(LoggerInfo + 6) = LoggerContext->InstanceGuid;
  LoggerInfo[16] = LoggerContext->LoggerMode;
  LoggerInfo[15] = LoggerContext->MaximumFileSize;
  LoggerInfo[17] = LoggerContext->FlushTimer;
  LoggerInfo[12] = LoggerContext->BufferSize >> 10;
  LoggerInfo[24] = LoggerContext->NumberOfBuffers;
  LoggerInfo[13] = LoggerContext->MinimumBuffers;
  LoggerInfo[14] = LoggerContext->MaximumBuffers;
  LoggerInfo[26] = LoggerContext->EventsLost;
  LoggerInfo[25] = LoggerContext->BuffersAvailable;
  BuffersWritten = LoggerContext->BuffersWritten;
  if( BuffersWritten <= LoggerContext->RealTimeBuffersDelivered )
    BuffersWritten = LoggerContext->RealTimeBuffersDelivered;
  LoggerInfo[27] = BuffersWritten;
  *((_QWORD *)LoggerInfo + 10) = 0i64;
  v5 = (LoggerContext->Flags >> 4) & 1;
  *((_QWORD *)LoggerInfo + 10) = v5;
  *((_QWORD *)LoggerInfo + 10) = v5 | (LoggerContext->Flags >> 26) & 2;
  LoggerInfo[28] = LoggerContext->LogBuffersLost;
  LoggerInfo[29] = LoggerContext->RealTimeBuffersLost;
  LoggerInfo[40] = LoggerContext->NumConsumers;
  LoggerInfo[19] = LoggerContext->FlushThreshold;
  if( LoggerContext->LoggerId )
    LoggerId = LoggerContext->LoggerId;
  else
    LoggerId = -1;
  *((_WORD *)LoggerInfo + 4) = LoggerId;
  LoggerThread = LoggerContext->LoggerThread;
  if( LoggerThread )
    *((_QWORD *)LoggerInfo + 15) = LoggerThread->Cid.UniqueThread;
  LoggerInfo[10] = LoggerContext->ClockType;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  ExAcquirePushLockExclusiveEx(&LoggerContext->LoggerLock, 0i64);
  Length = LoggerContext->LogFileName.Length;
  if( (_WORD)Length && *((_WORD *)LoggerInfo + 65) )
  {
    if( PreviousMode )
      ProbeForWrite(*((_QWORD *)LoggerInfo + 17), Length + 2, 2i64);
    RtlCopyUnicodeString((PUNICODE_STRING)LoggerInfo + 8, &LoggerContext->LogFileName);
  }
  v10 = _InterlockedExchangeAdd64(&LoggerContext->LoggerLock._bf_0, 0xFFFFFFFFFFFFFFFFui64);
  if( (v10 & 2) != 0 && (v10 & 4) == 0 )
    ExfTryToWakePushLock(&LoggerContext->LoggerLock);
  KeAbPostRelease(&LoggerContext->LoggerLock);
  v11 = LoggerContext->LoggerName.Length;
  if( (_WORD)v11
    && *((_WORD *)LoggerInfo + 73)
    && !(unsigned __int8)RtlEqualUnicodeString(&LoggerContext->LoggerName, (PCUNICODE_STRING)LoggerInfo + 9, 0) )
  {
    if( PreviousMode )
      ProbeForWrite(*((_QWORD *)LoggerInfo + 19), v11 + 2, 2i64);
    RtlCopyUnicodeString((PUNICODE_STRING)LoggerInfo + 9, &LoggerContext->LoggerName);
  }
  return 0;
}

Referenced by: