EtwpEnumerateTraceGuids

NTSTATUS __stdcall EtwpEnumerateTraceGuids(_ETW_SILODRIVERSTATE *SiloState, PVOID Buffer, UINT64 *OutBufferLen){
  NTSTATUS v4; 
  unsigned int v5; 
  _ETW_SILODRIVERSTATE *v7; 
  unsigned int v8; 
  _ETW_GUID_ENTRY *v9; 
  _ETW_GUID_ENTRY *NextGuidEntry; 
  unsigned __int16 *UserModeGlobalLogger; 
  unsigned int v12; 
  __int64(**v13)[2]; 
  char *v14; 
  __int64 v15; 
  int v16; 

  v4 = 0;
  v5 = 0;
  v7 = SiloState;
  v8 = *(_DWORD *)OutBufferLen / 0x24u;
  v9 = 0i64;
  while( 1 )
  {
    NextGuidEntry = EtwpGetNextGuidEntry(SiloState, v9, EtwTraceGuidType);
    if( !NextGuidEntry )
      break;
    if( ++v5 > 0x71C71C7 )
    {
LABEL_17:
      v4 = -2147483643;
      goto LABEL_18;
    }
    if( v5 <= v8 )
    {
      *(_GUID *)Buffer = NextGuidEntry->Guid;
      *((_DWORD *)Buffer + 7) = NextGuidEntry->LastEnable.EnableFlags.anonymous_0.LowPart;
      *((_DWORD *)Buffer + 5) = NextGuidEntry->LastEnable.LoggerId;
      *((_DWORD *)Buffer + 6) = NextGuidEntry->LastEnable.Level;
      *((_BYTE *)Buffer + 32) = NextGuidEntry->LastEnable._bf_b & 1;
      Buffer = (char *)Buffer + 36;
    }
    v9 = NextGuidEntry;
    SiloState = v7;
  }
  if( v7 == (_ETW_SILODRIVERSTATE *)EtwpHostSiloState )
    UserModeGlobalLogger = UKUSER_SHARED_DATA.UserModeGlobalLogger;
  else
    UserModeGlobalLogger = v7->SiloGlobals->UserSharedData->UserModeGlobalLogger;
  v12 = 0;
  v13 = &EtwpUmglProviders;
  v14 = (char *)Buffer + 28;
  do
  {
    v15 = *((unsigned __int8 *)v13 + 8);
    if( LOBYTE(UserModeGlobalLogger[v15]) )
    {
      if( ++v5 > 0x71C71C7 )
        goto LABEL_17;
      if( v5 <= v8 )
      {
        *(_OWORD *)(v14 - 28) = *(_OWORD *)*v13;
        *((_DWORD *)v14 - 2) = LOBYTE(UserModeGlobalLogger[v15]);
        v16 = HIBYTE(UserModeGlobalLogger[v15]);
        *((_DWORD *)v14 - 1) = 0;
        *(_DWORD *)v14 = v16;
        v14[4] = 1;
        v14 += 36;
      }
    }
    ++v12;
    v13 += 2;
  }
  while( v12 < 0xA );
LABEL_18:
  *(_DWORD *)OutBufferLen = 36 * v5;
  if( v4 >= 0 && v5 > v8 )
    return -1073741789;
  return v4;
}

Referenced by: