EtwWmitraceWorker

VOID __stdcall EtwWmitraceWorker(){
  _ETW_SILODRIVERSTATE *v0; 
  NTSTATUS SiloBySessionId; 
  unsigned int v2; 
  NTSTATUS Trace; 
  NTSTATUS v4; 
  NTSTATUS updated; 
  NTSTATUS v6; 
  NTSTATUS started; 
  UINT64 EnableProperty; 
  _EJOB *ServerSilo; 
  _STRING ServerSilo_8; 
  _UNICODE_STRING LoggerInfo[11]; 

  memset(LoggerInfo, 0i64, sizeof(LoggerInfo));
  ServerSilo = 0i64;
  ServerSilo_8 = 0i64;
  if( *(&ExBootDevicesRemovedEvent + 657) )
  {
    SiloBySessionId = PsGetSiloBySessionId(
                        *(&ExBootDevicesRemovedEvent + 657),
                        (PFLUSH_ADAPTER_BUFFERS_EX *)&ServerSilo);
    if( SiloBySessionId < 0 || !ServerSilo )
      goto LABEL_33;
    v0 = *(_ETW_SILODRIVERSTATE **)(*((_QWORD *)ServerSilo + 159) + 864i64);
  }
  else
  {
    v0 = (_ETW_SILODRIVERSTATE *)EtwpHostSiloState;
  }
  if( *(&ExBootDevicesRemovedEvent + 3016) == 1 )
  {
    EtwpPrepareWmitraceLoggerInfo((_WMI_LOGGER_INFORMATION *)LoggerInfo);
    RtlInitAnsiString(&ServerSilo_8, (PCSZ)&ExBootDevicesRemovedEvent + 2632);
    RtlAnsiStringToUnicodeString(&LoggerInfo[9], &ServerSilo_8, 1u);
    *(_QWORD *)(&LoggerInfo[3].MaximumLength + 1) = *(&ExBootDevicesRemovedEvent + 354);
    *(_DWORD *)&LoggerInfo[3].Length = *(&ExBootDevicesRemovedEvent + 710);
    *(_DWORD *)&LoggerInfo[4].Length = *(&ExBootDevicesRemovedEvent + 711);
    *(_DWORD *)(&LoggerInfo[4].MaximumLength + 1) = *(&ExBootDevicesRemovedEvent + 712);
    HIDWORD(LoggerInfo[3].Buffer) = *(&ExBootDevicesRemovedEvent + 707);
    if( *(&ExBootDevicesRemovedEvent + 2697) )
    {
      RtlInitAnsiString(&ServerSilo_8, (PCSZ)&ExBootDevicesRemovedEvent + 2697);
      RtlAnsiStringToUnicodeString(&LoggerInfo[8], &ServerSilo_8, 1u);
    }
    started = EtwpStartTrace(v0, (_WMI_LOGGER_INFORMATION *)LoggerInfo);
    SiloBySessionId = started;
    if( started >= 0 )
      *(&ExBootDevicesRemovedEvent + 656) = LOWORD(LoggerInfo[0].Buffer);
    else
      DbgPrintEx(0x17u, 3u, "wmitrace: EtwpStartTrace failed: 0x%x\n", (unsigned int)started);
    RtlFreeAnsiString(&LoggerInfo[9]);
    if( *(&ExBootDevicesRemovedEvent + 2697) )
      RtlFreeAnsiString(&LoggerInfo[8]);
  }
  else
  {
    v2 = 2;
    if( *(&ExBootDevicesRemovedEvent + 3016) == 2 )
    {
      EtwpPrepareWmitraceLoggerInfo((_WMI_LOGGER_INFORMATION *)LoggerInfo);
      Trace = EtwpQueryTrace(v0, (_WMI_LOGGER_INFORMATION *)LoggerInfo);
      SiloBySessionId = Trace;
      if( Trace < 0 )
        goto LABEL_22;
      v6 = EtwpStopTrace(v0, (_WMI_LOGGER_INFORMATION *)LoggerInfo, 0);
      SiloBySessionId = v6;
      if( v6 < 0 )
        DbgPrintEx(0x17u, 3u, "wmitrace: EtwpStopTrace failed: 0x%x\n", (unsigned int)v6);
    }
    else
    {
      if( *(&ExBootDevicesRemovedEvent + 3016) != 3 )
      {
        if( (unsigned __int8)(*(&ExBootDevicesRemovedEvent + 3016) - 4) > 2u )
        {
          SiloBySessionId = -1073741637;
          DbgPrintEx(0x17u, 3u, "Unknown command passed to EtwWmitraceWorker.\n");
          goto LABEL_33;
        }
        EtwpPrepareWmitraceLoggerInfo((_WMI_LOGGER_INFORMATION *)LoggerInfo);
        Trace = EtwpQueryTrace(v0, (_WMI_LOGGER_INFORMATION *)LoggerInfo);
        SiloBySessionId = Trace;
        if( Trace >= 0 )
        {
          if( *(&ExBootDevicesRemovedEvent + 3016) == 4 )
          {
            v2 = 1;
          }
          else if( *(&ExBootDevicesRemovedEvent + 3016) == 5 )
          {
            v2 = 0;
          }
          LODWORD(EnableProperty) = *(&ExBootDevicesRemovedEvent + 662);
          v4 = EtwEnableTrace(
                 (const _GUID *)((char *)&ExBootDevicesRemovedEvent + 2652),
                 0i64,
                 *(&ExBootDevicesRemovedEvent + 656),
                 v2,
                 *(&ExBootDevicesRemovedEvent + 2668),
                 *(&ExBootDevicesRemovedEvent + 329),
                 *(&ExBootDevicesRemovedEvent + 330),
                 EnableProperty);
          SiloBySessionId = v4;
          if( v4 < 0 )
            DbgPrintEx(0x17u, 3u, "wmitrace: EtwpEnableTraceEx failed: 0x%x\n", (unsigned int)v4);
          goto LABEL_33;
        }
LABEL_22:
        DbgPrintEx(0x17u, 3u, "wmitrace: EtwpQueryTrace failed: 0x%x\n", (unsigned int)Trace);
        goto LABEL_33;
      }
      EtwpPrepareWmitraceLoggerInfo((_WMI_LOGGER_INFORMATION *)LoggerInfo);
      Trace = EtwpQueryTrace(v0, (_WMI_LOGGER_INFORMATION *)LoggerInfo);
      SiloBySessionId = Trace;
      if( Trace < 0 )
        goto LABEL_22;
      *(_DWORD *)&LoggerInfo[4].Length |= 0x80000u;
      updated = EtwpUpdateTrace(v0, (_WMI_LOGGER_INFORMATION *)LoggerInfo);
      SiloBySessionId = updated;
      if( updated < 0 )
        DbgPrintEx(0x17u, 3u, "wmitrace: failed to enable KD_FILTER 0x%x\n", (unsigned int)updated);
    }
  }
LABEL_33:
  *(&ExBootDevicesRemovedEvent + 714) = SiloBySessionId;
  *(&ExBootDevicesRemovedEvent + 3016) = 0;
}

Referenced by: