SmKmEtwAppendProductName

NTSTATUS __fastcall SmKmEtwAppendProductName(__int64 *a1, __int64 a2, __int64 a3, _KEY_VALUE_FULL_INFORMATION **a4){
  _UNICODE_STRING *v5; 
  _FILE_OBJECT *v6; 
  __int64 v7; 
  wchar_t *v8; 
  unsigned int v9; 
  __int64 v10; 
  _UNICODE_STRING *v11; 
  NTSTATUS UniqueId; 
  __int64 v13; 
  __int64 v14; 
  wchar_t *v15; 
  __int64 v16; 
  size_t v17; 
  __int64 v18; 
  unsigned int v19; 
  __int64 v20; 
  __int64 v21; 
  int v22; 
  unsigned int v23; 
  __int64 v24; 
  __int64 v25; 
  NTSTATUS result; 
  UINT8 *v27; 
  _UNICODE_STRING *KeyName; 
  _FILE_OBJECT *v29; 

  v5 = *(_UNICODE_STRING **)(a2 + 24);
  v29 = 0i64;
  v6 = 0i64;
  KeyName = v5;
  if( !v5 )
  {
    SmKmStoreFileOpenVolume(*(_FILE_OBJECT **)(a2 + 8), &v29, (PDEVICE_OBJECT *)&KeyName);
    v5 = KeyName;
    v6 = v29;
  }
  v7 = a1[1] + *((unsigned int *)a1 + 6);
  v8 = (wchar_t *)((v7 + 1) & 0xFFFFFFFFFFFFFFFEui64);
  v9 = v7 + *((_DWORD *)a1 + 7) - *((_DWORD *)a1 + 6) - (_DWORD)v8;
  if( v5 )
  {
    v10 = 256i64;
    v11 = (_UNICODE_STRING *)((v7 + 1) & 0xFFFFFFFFFFFFFFFEui64);
    if( v9 < 0x100 )
      v10 = v9;
    UniqueId = SmKmVolumeQueryUniqueId(v5, v11, (UINT64 *)v10, a4, v27);
  }
  else
  {
    UniqueId = -1073741275;
  }
  if( UniqueId < 0 )
    *v8 = 0;
  v13 = -1i64;
  v14 = -1i64;
  do
    ++v14;
  while( v8[v14] );
  v15 = &v8[(unsigned int)v14 + 1];
  if( SmUniqueIdParseProductName(v8, v15, v9 - 2 * (_DWORD)v14 - 2) < 0 )
  {
    LODWORD(v13) = 0;
  }
  else
  {
    do
      ++v13;
    while( v15[v13] );
  }
  v16 = *((unsigned int *)a1 + 6);
  v17 = 2 * v13;
  v18 = a1[1];
  v19 = *((_DWORD *)a1 + 4);
  v20 = *a1;
  v21 = 2i64 * v19;
  v22 = v16 + 2;
  *(_WORD *)(v16 + v18) = v13;
  v23 = v19 + 1;
  v24 = v18 + (unsigned int)(v16 + 2);
  *(_QWORD *)(v20 + 8 * v21) = v16 + v18;
  *(_QWORD *)(v20 + 8 * v21 + 8) = 2i64;
  if( v15 )
    memmove((VOID *)(v18 + (unsigned int)(v16 + 2)), v15, v17);
  v25 = v20 + 16i64 * v23;
  *(_DWORD *)(v25 + 12) = 0;
  *(_QWORD *)v25 = v24;
  *(_DWORD *)(v25 + 8) = v17;
  *((_DWORD *)a1 + 4) = v23 + 1;
  result = v17 + v22;
  *((_DWORD *)a1 + 6) = v17 + v22;
  if( v6 )
    return ObfDereferenceObjectWithTag(v6, 0x746C6644ui64);
  return result;
}

Referenced by: