EtwpGetAutoLoggerEventNameFilter
void __fastcall EtwpGetAutoLoggerEventNameFilter(UINT64 a1, __int64 a2, INT64 a3, PVOID *a4, _DWORD *a5){
__int64 v6;
__int64 v7;
wchar_t *v10;
__int64 v11;
UINT64 v12;
VOID **PoolWithTag;
wchar_t *v14;
NTSTATUS v15;
INT64 v16;
VOID *v17;
__int64 v18;
UINT64 v19;
VOID **v20;
INT64 v21;
VOID *v22;
VOID **v23;
__int64 v24;
int v25;
_KEXCEPTION_FRAME *v26;
__int64 v27;
__int64 v28;
__int64 *v29;
unsigned __int16 Length;
unsigned int v31;
CHAR *v32;
INT64 v33;
INT64 v34;
INT64 v35;
INT64 v36;
VOID *KeyHandle;
VOID *Handle;
UINT64 UTF8StringActualByteCount;
_UNICODE_STRING UnicodeString;
_UNICODE_STRING DestinationString;
_OBJECT_ATTRIBUTES ObjectAttributes;
__int64 v43;
int v44;
__int64 v45;
int v46;
__int64 v47;
int v48;
__int64 v49;
int v50;
__int64 v51;
int v52;
__int64 v53;
int v54;
_UNICODE_STRING *p_UnicodeString;
__int64 v56[148];
v43 = a2;
UTF8StringActualByteCount = a1;
v6 = -1i64;
*a4 = 0i64;
*a5 = 0;
v7 = -1i64;
KeyHandle = 0i64;
Handle = 0i64;
memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
LOWORD(v36) = 0;
v10 = 0i64;
DestinationString = 0i64;
UnicodeString = 0i64;
do
++v7;
while( *(_WORD *)(a3 + 2 * v7) );
v11 = -1i64;
do
++v11;
while( *(_WORD *)(a1 + 2 * v11) );
v12 = (unsigned int)(2 * (v11 + v7) + 4);
PoolWithTag = ExAllocatePoolWithTag(1ui64, v12, 1350005829i64);
v14 = (wchar_t *)PoolWithTag;
if( PoolWithTag )
{
v15 = RtlStringCbPrintfW((WCHAR *)PoolWithTag, (unsigned int)v12, (WCHAR *)L"%ws\\%ws");
if( v15 )
goto LABEL_12;
RtlInitUnicodeString(&DestinationString, v14);
ObjectAttributes.Length = 48;
ObjectAttributes.ObjectName = &DestinationString;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v15 = ZwOpenKey(&KeyHandle, 0x20019ui64, &ObjectAttributes, v16, a3, v34, v36, (INT64)KeyHandle);
v17 = KeyHandle;
if( v15 < 0 )
v17 = 0i64;
KeyHandle = v17;
if( v43 )
{
v18 = -1i64;
do
++v18;
while( *(_WORD *)(a3 + 2 * v18) );
do
++v6;
while( *(_WORD *)(v43 + 2 * v6) );
v19 = (unsigned int)(2 * (v6 + v18) + 4);
v20 = ExAllocatePoolWithTag(1ui64, v19, 1350005829i64);
v10 = (wchar_t *)v20;
if( !v20 )
goto LABEL_13;
v15 = RtlStringCbPrintfW((WCHAR *)v20, (unsigned int)v19, (WCHAR *)L"%ws\\%ws");
if( v15 )
goto LABEL_12;
RtlInitUnicodeString(&DestinationString, v10);
ObjectAttributes.Length = 48;
ObjectAttributes.ObjectName = &DestinationString;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v15 = ZwOpenKey(&Handle, 0x20019ui64, &ObjectAttributes, v21, a3, v35, v36, (INT64)KeyHandle);
v22 = Handle;
if( v15 < 0 )
v22 = 0i64;
Handle = v22;
}
if( !KeyHandle && !Handle )
goto LABEL_12;
*a5 = 4096;
v23 = ExAllocatePoolWithTag(1ui64, 0x1000ui64, 1350005829i64);
*a4 = v23;
v24 = (__int64)v23;
if( v23 )
{
memset(v56, 0i64, 0x498u);
v45 = v24;
v56[0] = (__int64)EtwpQueryRegistryCallback;
LODWORD(v56[4]) = 11;
v56[3] = (__int64)&v44;
v44 = 11;
v56[2] = (__int64)L"MatchAnyKeyword";
LODWORD(v56[11]) = 11;
v56[10] = (__int64)&v46;
v56[9] = (__int64)L"MatchAllKeyword";
v47 = v24 + 8;
v56[17] = (__int64)&v48;
v56[16] = (__int64)L"Level";
v49 = v24 + 16;
v56[24] = (__int64)&v50;
v56[23] = (__int64)L"FilterIn";
v51 = v24 + 17;
v56[31] = (__int64)&v52;
v56[30] = (__int64)L"NameCount";
v53 = v24 + 18;
v46 = 11;
v56[38] = (__int64)&v54;
v56[7] = (__int64)EtwpQueryRegistryCallback;
v56[37] = (__int64)L"Names";
v56[40] = (__int64)&v36;
v56[14] = (__int64)EtwpQueryRegistryCallback;
LODWORD(v56[18]) = 4;
v48 = 4;
v56[21] = (__int64)EtwpQueryRegistryCallback;
LODWORD(v56[25]) = 4;
v50 = 4;
v56[28] = (__int64)EtwpQueryRegistryCallback;
LODWORD(v56[32]) = 4;
v52 = 4;
v56[35] = (__int64)EtwpQueryRegistryCallback;
p_UnicodeString = &UnicodeString;
LODWORD(v56[39]) = 1;
v54 = 1;
LOBYTE(v25) = RtlpQueryRegistryValues((_KTRAP_FRAME *)0x40000000, (_KEXCEPTION_FRAME *)KeyHandle);
if( v25 >= 0 )
{
v26 = (_KEXCEPTION_FRAME *)Handle;
if( Handle )
{
v27 = 2i64;
v56[5] = (__int64)*a4;
v56[12] = v56[5] + 8;
v56[19] = v56[5] + 16;
v28 = v56[5] + 17;
v29 = &v56[26];
do
{
*v29 = v28++;
v29 += 7;
--v27;
}
while( v27 );
v56[40] = (__int64)UnicodeString.Buffer;
LODWORD(v56[41]) = UnicodeString.Length;
RtlpQueryRegistryValues((_KTRAP_FRAME *)0x40000000, v26);
}
Length = UnicodeString.Length;
v31 = 0;
if( (UnicodeString.Length & 0xFFFE) != 0 )
{
do
{
if( UnicodeString.Buffer[v31] == 59 )
{
UnicodeString.Buffer[v31] = 0;
Length = UnicodeString.Length;
}
++v31;
}
while( v31 < Length >> 1 );
}
v32 = (char *)*a4 + 20;
LODWORD(UTF8StringActualByteCount) = *a5 - 20;
LODWORD(v33) = Length + 2;
v15 = RtlUnicodeToUTF8N(
v32,
(unsigned int)UTF8StringActualByteCount,
(PULONG)&UTF8StringActualByteCount,
UnicodeString.Buffer,
v33);
if( !v15 )
*a5 = UTF8StringActualByteCount + 20;
LABEL_12:
if( v15 >= 0 )
goto LABEL_15;
}
}
}
LABEL_13:
*a5 = 0;
if( *a4 )
{
ExFreePoolWithTag(*a4, 0);
*a4 = 0i64;
}
LABEL_15:
if( KeyHandle )
ZwClose((_HANDLE)KeyHandle);
if( v14 )
ExFreePoolWithTag(v14, 0);
if( Handle )
ZwClose((_HANDLE)Handle);
if( v10 )
ExFreePoolWithTag(v10, 0);
RtlFreeAnsiString(&UnicodeString);
}Referenced by:
EtwpGetAutoLoggerProviderFilter