IopInitActivityIdIrp
VOID __stdcall IopInitActivityIdIrp(_IRP *Irp){
char v2;
__m128i *RelatedActivityId;
const _EVENT_DESCRIPTOR *v4;
_ETHREAD *CurrentThread;
_GUID *v6;
__int64 v7;
char v8;
_LPGUID ActivityId[4];
__m128i v10;
*(_OWORD *)ActivityId = 0i64;
v10 = 0i64;
v2 = 0;
RelatedActivityId = 0i64;
v4 = 0i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
if( (KeGetPcr()->Prcb._bf_0 & 0x10001) == 0 )
{
v6 = (_GUID *)CurrentThread->ActivityId;
if( v6 )
{
if( IopIsActivityTracingEventEnabled(&IoTrace_KernelIo_AllocateIrp) )
{
RelatedActivityId = (__m128i *)v6;
v4 = &IoTrace_KernelIo_AllocateIrp;
goto LABEL_18;
}
*(_GUID *)ActivityId = *v6;
LABEL_17:
v2 = 1;
goto LABEL_18;
}
if( PnpIsSafeToExamineUserModeTeb() && (Irp->AllocationFlags & 0x21) != 33 )
{
v8 = 0;
if( KeGetPcr()->NtTib.$8E581AA5F14182E3A9376D7C6777905F::$DDD217EC770DED536E77C25F6874D4CC::Self )
{
v10 = *(__m128i *)&KeGetPcr()->NtTib.$8E581AA5F14182E3A9376D7C6777905F::$DDD217EC770DED536E77C25F6874D4CC::Self[105].SubSystemTib;
v8 = 1;
}
if( v8 )
{
v7 = *(_QWORD *)&NullGuid.Data1 - v10.m128i_i64[0];
if( *(_QWORD *)&NullGuid.Data1 == v10.m128i_i64[0] )
v7 = *(_QWORD *)NullGuid.Data4 - _mm_srli_si128(v10, 8).m128i_u64[0];
if( v7 )
{
if( IopIsActivityTracingEventEnabled(&IoTrace_UserInitiatedIo) )
{
RelatedActivityId = &v10;
v4 = &IoTrace_UserInitiatedIo;
goto LABEL_18;
}
*(__m128i *)ActivityId = v10;
goto LABEL_17;
}
}
}
}
LABEL_18:
if( !v2 )
EtwActivityIdControl(3ui64, (_GUID *)ActivityId);
if( IoSetActivityIdIrp(Irp, (_GUID *)ActivityId) >= 0 )
{
*(_WORD *)Irp->Tail.IrpExtension |= 2u;
if( RelatedActivityId )
EtwWriteEx(*(&stru_140C452E0 + 328), v4, 0i64, 0, (_LPCGUID)ActivityId, (_LPCGUID)RelatedActivityId, 0, 0i64);
}
}Referenced by:
IopAllocateBackpocketIrp
IopAllocateIrpPrivate
IopAllocateIrpWithExtension
IopAllocateReserveIrp
IovAllocateIrp