WmipSetTraceNotify

VOID __stdcall WmipSetTraceNotify(_DEVICE_OBJECT *DeviceObject, UINT64 TraceClass){
  __int64 *v3; 
  char v4; 
  INT64 v5; 
  VOID **Irp; 
  _IRP *v7; 
  ULONG v8; 
  UINT64 BufferLength; 
  __int128 Buffer; 

  Buffer = 0i64;
  switch( (_DWORD)TraceClass )
  {
    case 0x100000:
      v3 = &EtwpDiskIoNotifyRoutines;
LABEL_3:
      LODWORD(Buffer) = 1;
LABEL_4:
      *((_QWORD *)&Buffer + 1) = v3;
      break;
    case 0x200000:
      v3 = (__int64 *)*(&stru_140CF2E80 + 925);
      goto LABEL_3;
    case 0x400000:
      LODWORD(Buffer) = 2;
      v3 = (__int64 *)&EtwpFileIoNotifyRoutines;
      goto LABEL_4;
    case 0x800000:
      v3 = &qword_140CED0D8;
      goto LABEL_3;
  }
  KeWaitForSingleObject((UINT64)&ExBootDevicesRemovedEvent + 3072, 0, 0, 0, 0i64);
  v4 = *(_BYTE *)(*(&ExBootDevicesRemovedEvent + 391) + 76i64) + 1;
  KeReleaseMutex((_KMUTANT *)((char *)&ExBootDevicesRemovedEvent + 3072), 0);
  LOBYTE(v5) = v4;
  Irp = IoAllocateIrp(v5, 0);
  v7 = (_IRP *)Irp;
  if( Irp )
  {
    Irp[23] = (char *)Irp[23] - 72;
    --*((_BYTE *)Irp + 67);
    *((_QWORD *)Irp[23] + 5) = *(&ExBootDevicesRemovedEvent + 391);
    v8 = IoWMIDeviceObjectToProviderId(DeviceObject);
    LODWORD(BufferLength) = 16;
    WmipForwardWmiIrp(v7, 0xDu, v8, 0i64, BufferLength, &Buffer);
    IoFreeIrp(v7);
  }
}

Referenced by: