EtwpAddDebugInfoEvents

VOID __stdcall EtwpAddDebugInfoEvents(
        _WMI_LOGGER_CONTEXT *LoggerContext,
        _WMI_BUFFER_HEADER *Buffer,
        UINT64 BufferSize,
        _LARGE_INTEGER *TimeStamp,
        UINT64 Flags){
  _LARGE_INTEGER *v5; 
  int v6; 
  char v8; 
  int v10; 
  __int64 v11; 
  __int64 v12; 
  int v13; 
  unsigned int DecodeControlCount; 
  _LIST_ENTRY *Flink; 
  __int64 v16; 
  _ETW_DECODE_CONTROL_ENTRY *DecodeControlList; 
  _GUID *v18; 
  _ETW_DECODE_CONTROL_ENTRY *v19; 
  UINT64 DataSize; 
  UINT64 RemainingBufferSize; 
  UINT64 EventSize; 
  __int64 v24; 

  LODWORD(EventSize) = 0;
  v5 = (_LARGE_INTEGER *)&v24;
  v24 = 0i64;
  v6 = BufferSize - *((_DWORD *)Buffer + 12);
  v8 = Flags;
  if( TimeStamp )
    v5 = TimeStamp;
  v10 = Flags & 2;
  LODWORD(Flags) = v10;
  if( v10 )
    ExAcquirePushLockExclusiveEx(&LoggerContext->LoggerLock, 0i64);
  if( (v8 & 1) != 0 && LoggerContext->DebugIdTrackingList.Flink != &LoggerContext->DebugIdTrackingList )
  {
    v11 = -1i64;
    do
      ++v11;
    while( NtBuildLabEx[v11] );
    LODWORD(RemainingBufferSize) = v6;
    LODWORD(DataSize) = v11 + 1;
    LODWORD(v12) = EtwpAddEventToBuffer(Buffer, 0x42u, v5, NtBuildLabEx, DataSize, RemainingBufferSize, &EventSize);
    if( !v12 )
      goto LABEL_20;
    v6 -= EventSize;
  }
  v13 = v8 & 4;
  if( v13 )
  {
    DecodeControlList = LoggerContext->DecodeControlList;
    DecodeControlCount = 0;
    if( !DecodeControlList )
      goto LABEL_14;
    do
    {
      if( DecodeControlList->ConsumersNotified )
        break;
      DecodeControlList = DecodeControlList->Next;
      ++DecodeControlCount;
    }
    while( DecodeControlList );
  }
  else
  {
    DecodeControlCount = LoggerContext->DecodeControlCount;
  }
  if( DecodeControlCount )
  {
    LODWORD(RemainingBufferSize) = v6;
    LODWORD(DataSize) = 32 * DecodeControlCount;
    LODWORD(v18) = EtwpAddEventToBuffer(Buffer, 0x44u, v5, 0i64, DataSize, RemainingBufferSize, &EventSize);
    if( v18 )
    {
      v19 = LoggerContext->DecodeControlList;
      do
      {
        *v18 = v19->Decode;
        v18 += 2;
        v18[-1] = v19->Control;
        v19 = v19->Next;
        --DecodeControlCount;
      }
      while( DecodeControlCount );
      v6 -= EventSize;
    }
  }
LABEL_14:
  Flink = LoggerContext->DebugIdTrackingList.Flink;
  if( Flink != &LoggerContext->DebugIdTrackingList )
  {
    do
    {
      if( !v13 || !LOBYTE(Flink[1].Flink) )
      {
        LODWORD(RemainingBufferSize) = v6;
        LODWORD(DataSize) = HIDWORD(Flink[1].Flink) - 4;
        LODWORD(v16) = EtwpAddEventToBuffer(
                         Buffer,
                         0x40u,
                         v5,
                         (UINT8 *)&Flink[1].Blink + 4,
                         DataSize,
                         RemainingBufferSize,
                         &EventSize);
        if( !v16 )
          break;
        v6 -= EventSize;
      }
      Flink = Flink->Flink;
    }
    while( Flink != &LoggerContext->DebugIdTrackingList );
    v10 = Flags;
  }
LABEL_20:
  if( v10 )
  {
    if( (_InterlockedExchangeAdd64(&LoggerContext->LoggerLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(&LoggerContext->LoggerLock);
    KeAbPostRelease(&LoggerContext->LoggerLock);
  }
}

Referenced by: