EtwpSetMark

NTSTATUS __stdcall EtwpSetMark(
        UINT64 LoggerId,
        _ETW_SET_MARK_INFORMATION *MarkInfo,
        UINT64 MarkSize,
        UINT8 AllowFlush,
        INT8 RequestorMode){
  int v5; 
  NTSTATUS v8; 
  char v9; 
  INT64 a5; 
  UINT64 a7; 
  INT64 a2; 
  int v14; 
  int v15; 
  __int64 *v16; 
  int v17; 
  int v18; 

  v5 = MarkSize;
  v8 = 0;
  if( (unsigned int)MarkSize <= 4 )
    return -1073741811;
  if( (unsigned int)MarkSize > 0xFFDD )
    return -1073741675;
  if( RequestorMode )
  {
    if( ((unsigned __int8)MarkInfo & 3) != 0 )
      ExRaiseDatatypeMisalignment();
    if( (unsigned __int64)MarkInfo + (unsigned int)MarkSize > 0x7FFFFFFF0000i64
      || (_ETW_SET_MARK_INFORMATION *)((char *)MarkInfo + (unsigned int)MarkSize) < MarkInfo )
    {
      MEMORY[0x7FFFFFFF0000] = 0;
    }
  }
  v9 = 0;
  if( (MarkInfo->Flag & 1) != 0 && AllowFlush )
  {
    if( SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, RequestorMode) )
    {
      v9 = 1;
      MmEmptyAllWorkingSets();
    }
    else
    {
      v8 = -1073741727;
    }
  }
  a2 = (INT64)MarkInfo->Mark;
  v14 = v5 - 4;
  v15 = 0;
  v16 = &EtwpNull;
  v17 = 2;
  v18 = 0;
  LODWORD(a7) = 12544;
  LODWORD(a5) = 2;
  EtwpLogSystemEventUnsafe(
    *(_ETW_SILODRIVERSTATE **)(LoggerId + 1080),
    (INT64)&a2,
    (INT64)KeGetCurrentThread(),
    *(unsigned int *)LoggerId,
    a5,
    3874,
    a7);
  if( v9 )
    MmIdentifyPhysicalMemory(*(_QWORD *)(LoggerId + 1080), *(unsigned int *)LoggerId, 0x275ui64);
  return v8;
}

Referenced by: