EtwpTraceHandle

VOID __stdcall EtwpTraceHandle(UINT16 HookId, VOID *Handle, VOID *Object, _OBJECT_TYPE *ObjectType){
  unsigned int Key; 
  unsigned int v6; 
  unsigned int v7; 
  bool v8; 
  __int64 v9; 
  unsigned int v10; 
  __int64 v11; 
  int v12; 
  _WORD *v13; 
  int v14; 
  VOID **PoolWithTag; 
  __int16 v16; 
  VOID *v17; 
  UINT64 v18; 
  NTSTATUS v19; 
  int v20; 
  __int64 v21; 
  UINT64 ReturnLength; 
  unsigned int v23; 
  VOID *v24; 
  int v25; 
  __int16 Index; 
  __int16 v27; 
  VOID *Objecta; 
  VOID *v29; 
  VOID **v30; 
  __int64 v31[2]; 
  int v32; 
  int v33; 
  char P[272]; 

  Objecta = Object;
  Key = ObjectType->Key;
  v6 = 0;
  v29 = Handle;
  v7 = *(_DWORD *)(EtwpHostSiloState + 4224);
  v8 = !_BitScanForward((unsigned int *)&v9, v7);
  WORD2(ReturnLength) = HookId;
  LODWORD(ReturnLength) = 0;
  v27 = 0;
  v23 = Key;
  if( !v8 )
  {
    v10 = 1;
    do
    {
      v7 &= v7 - 1;
      v11 = 32i64 * (unsigned int)v9 + EtwpHostSiloState + 4260;
      if( v11 )
      {
        if( (*(_DWORD *)(v11 + 16) & 0x40) != 0 )
        {
          v12 = 0;
          v13 = (_WORD *)((char *)&ExBootDevicesRemovedEvent + 20 * v9 + 1568);
          if( *v13 )
          {
            while( 1 )
            {
              v14 = ExCheckSingleFilter(Key, *(unsigned int *)&v13[2 * v12 + 2]);
              Key = v23;
              if( v14 )
                break;
              if( ++v12 >= (unsigned int)(unsigned __int16)*v13 )
                goto LABEL_10;
            }
            v6 |= 1 << v9;
          }
        }
      }
LABEL_10:
      v8 = !_BitScanForward((unsigned int *)&v9, v7);
    }
    while( !v8 );
    if( v6 )
    {
      PoolWithTag = (VOID **)P;
      v16 = WORD2(ReturnLength);
      v17 = Objecta;
      v25 = (int)v29;
      Index = ObjectType->Index;
      v30 = &v24;
      v24 = Objecta;
      v31[0] = 14i64;
      if( WORD2(ReturnLength) == 4385 )
      {
        v18 = 272i64;
        LODWORD(ReturnLength) = 272;
        while( 1 )
        {
          v19 = ObQueryNameStringMode(v17, (_OBJECT_NAME_INFORMATION *)PoolWithTag, v18, &ReturnLength, 0);
          if( v19 != -1073741820 )
            break;
          if( PoolWithTag != (VOID **)P )
            ExFreePoolWithTag(PoolWithTag, 0);
          PoolWithTag = ExAllocatePoolWithTag(1ui64, (unsigned int)ReturnLength, 1953985605i64);
          if( !PoolWithTag )
            goto LABEL_23;
          v18 = (unsigned int)ReturnLength;
        }
        if( !v19 )
        {
          v20 = 0x2000;
          if( *(_WORD *)PoolWithTag < 0x2000u )
            v20 = *(unsigned __int16 *)PoolWithTag;
          v10 = 2;
          v31[1] = (__int64)PoolWithTag[1];
          v32 = v20;
          v33 = 0;
        }
      }
LABEL_23:
      v21 = 2i64 * v10;
      v31[v21 - 1] = (__int64)&EtwpNull;
      v31[v21] = 2i64;
      EtwpTraceKernelEventWithFilter((__int64)&v30, v10 + 1, v6, v16, 273684738);
      if( PoolWithTag )
      {
        if( PoolWithTag != (VOID **)P )
          ExFreePoolWithTag(PoolWithTag, 0);
      }
    }
  }
}

Referenced by: