IopErrorLogThread

VOID __stdcall IopErrorLogThread(PVOID StartContext){
  WCHAR v1; 
  UINT64 *v2; 
  INT64 v3; 
  INT64 v4; 
  UINT64 v5; 
  __int64 v6; 
  int v7; 
  unsigned __int16 Length; 
  wchar_t *Buffer; 
  __int16 v10; 
  char v11; 
  CHAR *p_P; 
  UINT64 v13; 
  UINT64 v14; 
  struct _DMA_ADAPTER *v15; 
  __int64 v16; 
  WCHAR v17; 
  __int64 v18; 
  int v19; 
  const WCHAR *v20; 
  __int16 v21; 
  UINT64 SidLength; 
  struct _UNICODE_STRING Name; 
  UINT64 PacketSize; 
  PVOID SidData; 
  struct _UNICODE_STRING v26; 
  __int64 v27; 
  struct _UNICODE_STRING DestinationString; 
  OBJECT_NAME_INFORMATION ObjectNameInfo; 
  wchar_t pszDest[256]; 
  wchar_t DeviceName[256]; 
  char P; 
  Name = 0i64;
  WORD2(SidLength) = 0;
  v26 = 0i64;
  SidData = 0i64;
  DestinationString = 0i64;
  if( ErrorLogSessionOpened )
  {
    while( 1 )
    {
LABEL_29:
      LODWORD(SidLength) = 0;
      IopErrorLogGetEntry();
      v18 = v16;
      if( !v16 )
        return;
      v6 = *(_QWORD *)(v16 + 24);
      v7 = *(unsigned __int16 *)(v16 - 6) - 48;
      v27 = v6;
      LODWORD(PacketSize) = v7;
      if( v6 )
      {
        RtlInitUnicodeString(&Name, 0i64, v17);
        if( *(_QWORD *)(v6 + 64) )
          Name = *(struct _UNICODE_STRING *)(v6 + 56);
        Length = Name.Length;
        if( Name.Length )
        {
LABEL_8:
          Buffer = &Name.Buffer[((unsigned __int64)Length >> 1) - 1];
          if( *Buffer == 92 )
            goto LABEL_12;
          do
          {
            if( Buffer == Name.Buffer )
              break;
            --Buffer;
          }
          while( *Buffer != 92 );
          if( *Buffer == 92 )
LABEL_12:
            ++Buffer;
          v10 = LOWORD(Name.Buffer) - (_WORD)Buffer;
          Name.Buffer = Buffer;
          Length += v10;
          Name.Length = Length;
          goto LABEL_14;
        }
        LODWORD(SidLength) = 0;
        if( (int)ObQueryNameStringMode((VOID *)v6, &ObjectNameInfo, 0x110ui64, &SidLength, 0) >= 0 && (_DWORD)SidLength )
        {
          Name = ObjectNameInfo.Name;
          goto LABEL_41;
        }
        v20 = &word_1407CF120;
      }
      else
      {
        v20 = L"Application Popup";
      }
      RtlInitUnicodeString(&Name, v20, v17);
LABEL_41:
      Length = Name.Length;
      if( Name.Length )
        goto LABEL_8;
      Buffer = Name.Buffer;
LABEL_14:
      LODWORD(SidLength) = 0;
      v11 = 0;
      p_P = &P;
      v13 = 272i64;
      if( !*(_QWORD *)(v18 + 16) )
        goto LABEL_15;
      while( 1 )
      {
        v19 = ObQueryNameStringMode(*(VOID **)(v18 + 16), (OBJECT_NAME_INFORMATION *)p_P, v13, &SidLength, 0);
        if( v19 != -1073741820 )
          break;
        if( v11 )
          goto LABEL_15;
        p_P = IopVerifierExAllocatePool_4(PagedPool, (unsigned int)SidLength);
        if( !p_P )
          goto LABEL_15;
        v13 = (unsigned int)SidLength;
        v11 = 1;
      }
      v14 = 0i64;
      if( v19 >= 0 && (_DWORD)SidLength )
      {
        v26 = *(struct _UNICODE_STRING *)p_P;
      }
      else
      {
LABEL_15:
        RtlInitUnicodeString(&v26, &word_1407CF120, v13);
        v14 = 0i64;
      }
      pszDest[0] = 0;
      DeviceName[0] = 0;
      if( Buffer )
        RtlStringCchCopyNW(pszDest, 0x100ui64, Buffer, (unsigned __int64)Length >> 1);
      if( v26.Buffer )
        RtlStringCchCopyNW(DeviceName, 0x100ui64, v26.Buffer, (unsigned __int64)v26.Length >> 1);
      if( v11 == 1 )
        ExFreePoolWithTag(p_P, 0);
      if( (unsigned int)(*(_DWORD *)(v18 + 52) - 1074004004) <= 1 && !wcsicmp(pszDest, L"NTFS") )
      {
        v21 = *(_WORD *)(v18 + 84);
        *(_WORD *)(v18 + 42) -= v21;
        WORD2(SidLength) = v21;
        SidData = (PVOID)(v18 + 120);
      }
      if( EtwWriteErrorLogEntry(
             v14,
             (_IO_ERROR_LOG_PACKET *)(v18 + 40),
             (unsigned int)PacketSize,
             (_LARGE_INTEGER *)(v18 + 32),
             pszDest,
             DeviceName,
             WORD2(SidLength),
             SidData) < 0 )
      {
        IopErrorLogRequeueEntry((_LIST_ENTRY *)v18);
        goto LABEL_49;
      }
      _InterlockedExchangeAdd(&IopErrorLogAllocation, -*(unsigned __int16 *)(v18 - 6));
      v15 = *(struct _DMA_ADAPTER **)(v18 + 16);
      if( v15 )
        HalPutDmaAdapter(v15);
      if( v27 )
        HalPutDmaAdapter(*(PADAPTER_OBJECT *)(v18 + 24));
      ExFreePoolWithTag((PVOID)(v18 - 8), 0);
    }
  }
  RtlInitUnicodeString(&DestinationString, L"Eventlog-System", v1);
  if( (int)EtwQueryTraceHandleByLoggerName(&DestinationString, (UINT64 *)IopErrorLogSession) >= 0 )
  {
    ErrorLogSessionOpened = 1;
    goto LABEL_29;
  }
LABEL_49:
  IopErrorLogQueueRequest(v3, v2, v4, v5);
}

Referenced by: