tlgWriteAgg

NTSTATUS __fastcall tlgWriteAgg(
        __int64 a1,
        unsigned __int8 *a2,
        __int64 a3,
        unsigned __int8 a4,
        PEVENT_DATA_DESCRIPTOR UserData){
  unsigned __int64 v7; 
  unsigned __int8 *v8; 
  NTSTATUS result; 
  unsigned __int8 AggregateFieldTypes; 
  _EVENT_DESCRIPTOR EventDescriptor; 

  *(_DWORD *)&EventDescriptor.Id = *a2 << 24;
  *(_DWORD *)&EventDescriptor.Level = *(unsigned __int16 *)(a2 + 1);
  v7 = *(_QWORD *)(a2 + 3);
  v8 = a2 + 11;
  EventDescriptor.Keyword = v7;
  UserData->Ptr = *(_QWORD *)(a1 + 8);
  UserData->Size = **(unsigned __int16 **)(a1 + 8);
  UserData->Reserved = 2;
  UserData[1].Ptr = (unsigned __int64)v8;
  UserData[1].Size = *(unsigned __int16 *)v8;
  UserData[1].Reserved = 1;
  result = -1073741811;
  if( *(void(__fastcall **)(const struct _GUID *, __int64, char, __int64, unsigned __int64, struct _EVENT_FILTER_DESCRIPTOR *, _TLG_AGGR_SESSION *))(a1 + 40) == TlgAggregateInternalRegisteredProviderEtwCallback )
  {
    AggregateFieldTypes = ExtractAggregateFieldTypes(
                            (__int64)TlgAggregateInternalRegisteredProviderEtwCallback,
                            (__int64)UserData);
    if( AggregateFieldTypes )
      return InsertEventEntryInLookUpTable(a1, (__int128 *)&EventDescriptor, a4, (__int64)UserData, AggregateFieldTypes);
    else
      return EtwWriteEx(*(_QWORD *)(a1 + 32), &EventDescriptor, 0i64, 0, 0, 0, a4, UserData);
  }
  return result;
}

Referenced by: