EtwActivityIdControl

NTSTATUS __stdcall EtwActivityIdControl(UINT64 ControlCode, _GUID *ActivityId){
  volatile signed __int64 *EtwSupport; 
  _ETHREAD *CurrentThread; 
  char *Teb; 
  _EWOW64PROCESS *WoW64Process; 
  _GUID *v7; 
  int v8; 
  unsigned __int16 Machine; 
  int v10; 
  int v11; 
  volatile signed __int64 *v12; 
  _GUID v13; 
  NTSTATUS v14; 
  volatile signed __int64 *v15; 

  v14 = 0;
  if( (_DWORD)ControlCode == 3 )
  {
    EtwSupport = (volatile signed __int64 *)KeGetCurrentPrcb()->EtwSupport;
    *(_QWORD *)ActivityId->Data4 = _InterlockedIncrement64(EtwSupport + 1);
    *(_QWORD *)&ActivityId->Data1 = *EtwSupport;
    return v14;
  }
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  if( (CurrentThread->Tcb._bf_0 & 0x400) != 0 || CurrentThread->Tcb.ApcStateIndex == 1 )
    Teb = 0i64;
  else
    Teb = (char *)CurrentThread->Tcb.Teb;
  if( Teb )
  {
    v15 = (volatile signed __int64 *)(Teb + 5904);
    WoW64Process = KeGetCurrentThread()->ApcState.Process->WoW64Process;
    if( WoW64Process && ((Machine = WoW64Process->Machine, Machine == 332) || Machine == 452) )
    {
      v7 = (_GUID *)(Teb + 12112);
      v15 = (volatile signed __int64 *)(Teb + 12112);
    }
    else
    {
      v7 = (_GUID *)(Teb + 5904);
    }
    v8 = ControlCode - 1;
    if( v8 )
    {
      v10 = v8 - 1;
      if( v10 )
      {
        v11 = v10 - 2;
        if( v11 )
        {
          if( v11 == 1 )
          {
            *ActivityId = *v7;
            v12 = (volatile signed __int64 *)KeGetCurrentPrcb()->EtwSupport;
            *((_QWORD *)v15 + 1) = _InterlockedIncrement64(v12 + 1);
            *v15 = *v12;
          }
          else
          {
            return -1073741811;
          }
        }
        else
        {
          v13 = *v7;
          *v7 = *ActivityId;
          *ActivityId = v13;
        }
      }
      else
      {
        *v7 = *ActivityId;
      }
    }
    else
    {
      *ActivityId = *v7;
    }
    return v14;
  }
  return -1073741637;
}

Referenced by: