EtwWriteStartScenario

NTSTATUS __fastcall EtwWriteStartScenario(
        REGHANDLE RegHandle,
        PCEVENT_DESCRIPTOR EventDescriptor,
        VOID *OutBuffer,
        ULONG UserDataCount,
        PEVENT_DATA_DESCRIPTOR a5){
  int ProviderIdFromHandle; 
  PEVENT_DATA_DESCRIPTOR UserData; 
  UINT64 ReturnLength; 
  _GUID ProviderId; 

  LODWORD(ReturnLength) = 0;
  ProviderId = 0i64;
  if( !EventDescriptor || !OutBuffer )
    return -1073741811;
  if( !EtwEventEnabled(RegHandle, EventDescriptor) )
    return -1073741816;
  ProviderIdFromHandle = EtwGetProviderIdFromHandle(RegHandle, 0, &ProviderId);
  if( ProviderIdFromHandle >= 0 )
  {
    if( *(_DWORD *)OutBuffer
      || *((_WORD *)OutBuffer + 2)
      || *((_WORD *)OutBuffer + 3)
      || *((_BYTE *)OutBuffer + 8)
      || *((_BYTE *)OutBuffer + 9)
      || *((_BYTE *)OutBuffer + 10)
      || *((_BYTE *)OutBuffer + 11)
      || *((_BYTE *)OutBuffer + 12)
      || *((_BYTE *)OutBuffer + 13)
      || *((_BYTE *)OutBuffer + 14)
      || *((_BYTE *)OutBuffer + 15)
      || (LODWORD(UserData) = 16,
          ProviderIdFromHandle = ZwTraceControl(0xCui64, 0i64, 0i64, OutBuffer, (UINT64)UserData, &ReturnLength),
          ProviderIdFromHandle >= 0) )
    {
      ProviderIdFromHandle = EtwWrite(RegHandle, EventDescriptor, (_LPCGUID)OutBuffer, UserDataCount, a5);
      WdipStartEndScenario(&ProviderId, (const _GUID *)OutBuffer, &EventDescriptor->Id, 10);
    }
  }
  return ProviderIdFromHandle;
}

Referenced by: