EtwpLogKernelEvent

void __fastcall EtwpLogKernelEvent(
        __int64 a1,
        _ETW_SILODRIVERSTATE *a2,
        unsigned int a3,
        unsigned int a4,
        UINT16 a5,
        unsigned int a6){
  __int64 v6; 
  unsigned int v7; 
  __int64 v10; 
  _ETW_LOGGER_HANDLE v11; 
  char v12; 
  __int64 v13; 
  _WMI_LOGGER_CONTEXT **EtwpLoggerContext; 
  _WMI_LOGGER_CONTEXT *v15; 
  unsigned int v16; 
  unsigned int v17; 
  __m128i v18; 
  __m128i v19; 
  unsigned int v20; 
  __int64 v21; 
  __m128i v22; 
  __m128i v23; 
  __int64 v24; 
  __int64 v25; 
  __int64 v26; 
  __m128i v27; 
  __m128i v28; 
  __m128i v29; 
  __m128i v30; 
  _DWORD *v31; 
  __int64 v32; 
  unsigned int v33; 
  _QWORD *v34; 
  char *v35; 
  char *v36; 
  __int64 v37; 
  signed __int64 *v38; 
  signed __int64 v39; 
  __int64 v40; 
  signed __int64 v41; 
  unsigned int v42; 
  UINT16 v43; 
  int v44; 
  int v45; 
  _ETHREAD *CurrentThread; 
  _QWORD *v47; 
  _DWORD *v48; 
  _QWORD *v49; 
  int v50; 
  _ETW_PMC_SUPPORT *PmcData; 
  int v52; 
  _ETW_LBR_SUPPORT *LbrData; 
  _ETW_IPT_SUPPORT *IptData; 
  UINT64 Flags; 
  UINT64 Flagsa; 
  UINT64 v57; 
  size_t Size; 
  _DWORD v59[3]; 
  VOID *v60; 
  _WMI_LOGGER_CONTEXT *LoggerContext; 
  unsigned __int64 v62; 
  _ETW_BUFFER_HANDLE BufferHandle[4]; 
  __int64 v64; 

  v6 = a3;
  v7 = 0;
  *(_OWORD *)BufferHandle = 0i64;
  v64 = 0i64;
  *(_QWORD *)&v59[1] = 0i64;
  v10 = a1;
  v11.DereferenceAndLeave = 0;
  KeAreInterruptsEnabled(a1, a2);
  if( v12 && KeGetCurrentIrql() < 2u )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    v13 = v6;
    if( !ExAcquireRundownProtectionCacheAwareEx((INT64)a2->EtwpLoggerRundown[v6], 1i64) )
    {
      KeLeaveCriticalRegion();
      return;
    }
    v11.DereferenceAndLeave = 1;
  }
  else
  {
    v13 = v6;
  }
  EtwpLoggerContext = a2->EtwpLoggerContext;
  v62 = 8 * v13;
  v15 = EtwpLoggerContext[v13];
  LoggerContext = v15;
  if( ((unsigned __int8)v15 & 1) != 0 )
  {
    EtwpCloseLogger((unsigned int)v6, a2, v11);
    return;
  }
  if( v15 )
  {
    Size = 0;
    v16 = 0;
    v17 = 0;
    if( a4 )
    {
      if( a4 >= 8 )
      {
        v18 = 0i64;
        v19 = 0i64;
        v20 = 2;
        do
        {
          v21 = 2i64 * v17;
          v17 += 8;
          v22 = _mm_unpacklo_epi32(
                  _mm_cvtsi32_si128(*(_DWORD *)(v10 + 8 * v21 + 8)),
                  _mm_cvtsi32_si128(*(_DWORD *)(v10 + 16i64 * v20 + 8)));
          v23 = _mm_cvtsi32_si128(*(_DWORD *)(v10 + 16i64 * (v20 + 4) + 8));
          v24 = 2i64 * (v20 + 5);
          v25 = 2i64 * (v20 + 3);
          v26 = 2i64 * (v20 + 2);
          v27 = _mm_add_epi32(
                  _mm_unpacklo_epi32(
                    v22,
                    _mm_unpacklo_epi32(
                      _mm_cvtsi32_si128(*(_DWORD *)(v10 + 16i64 * (v20 - 1) + 8)),
                      _mm_cvtsi32_si128(*(_DWORD *)(v10 + 16i64 * (v20 + 1) + 8)))),
                  v18);
          v20 += 8;
          v18 = v27;
          v28 = _mm_add_epi32(
                  _mm_unpacklo_epi32(
                    _mm_unpacklo_epi32(_mm_cvtsi32_si128(*(_DWORD *)(v10 + 8 * v26 + 8)), v23),
                    _mm_unpacklo_epi32(
                      _mm_cvtsi32_si128(*(_DWORD *)(v10 + 8 * v25 + 8)),
                      _mm_cvtsi32_si128(*(_DWORD *)(v10 + 8 * v24 + 8)))),
                  v19);
          v19 = v28;
        }
        while( v17 < (a4 & 0xFFFFFFF8) );
        v29 = _mm_add_epi32(v28, v18);
        v30 = _mm_add_epi32(v29, _mm_srli_si128(v29, 8));
        v16 = _mm_cvtsi128_si32(_mm_add_epi32(v30, _mm_srli_si128(v30, 4)));
        Size = v16;
      }
      if( v17 < a4 )
      {
        v31 = (_DWORD *)(16i64 * v17 + v10 + 8);
        v32 = a4 - v17;
        do
        {
          v16 += *v31;
          v31 += 4;
          --v32;
        }
        while( v32 );
        Size = v16;
      }
    }
    if( (a6 & 0x100) != 0 )
    {
      LODWORD(Flags) = a6;
      if( (a6 & 0x10000000) != 0 )
      {
        v49 = EtwpReserveTraceBuffer(v15, v16 + 24, BufferHandle, (_LARGE_INTEGER *)&v59[1], Flags);
        if( !v49 )
          goto LABEL_34;
        *(_DWORD *)v49 = (unsigned __int8)a6 | 0xC0040000;
        v49[2] = *(_QWORD *)&v59[1];
        *((_WORD *)v49 + 2) = v16 + 24;
        *((_WORD *)v49 + 3) = a5;
        *((_DWORD *)v49 + 2) = KeGetCurrentThread()[1].CurrentRunTime;
        *((_DWORD *)v49 + 3) = KeGetCurrentThread()->ApcState.Process->UniqueProcessId;
        v35 = (char *)(v49 + 3);
      }
      else
      {
        v60 = KeGetCurrentThread();
        v47 = EtwpReserveTraceBuffer(v15, v16 + 32, BufferHandle, (_LARGE_INTEGER *)&v59[1], Flags);
        if( !v47 )
          goto LABEL_34;
        v48 = v60;
        *(_DWORD *)v47 = (unsigned __int8)a6 | 0xC0020000;
        v47[2] = *(_QWORD *)&v59[1];
        *((_WORD *)v47 + 2) = v16 + 32;
        *((_WORD *)v47 + 3) = a5;
        *((_DWORD *)v47 + 2) = v48[288];
        *((_DWORD *)v47 + 3) = v48[286];
        *((_DWORD *)v47 + 6) = v48[163];
        *((_DWORD *)v47 + 7) = v48[183];
        v35 = (char *)(v47 + 4);
      }
    }
    else
    {
      v33 = v15->Flags;
      if( (v33 & 0xC00) == 0 )
      {
LABEL_17:
        LODWORD(Flags) = a6;
        v34 = EtwpReserveTraceBuffer(v15, v16 + 16, BufferHandle, (_LARGE_INTEGER *)&v59[1], Flags);
        if( !v34 )
          goto LABEL_34;
        v34[1] = *(_QWORD *)&v59[1];
        *(_DWORD *)v34 = (unsigned __int8)a6 | 0xC0110000;
        *((_WORD *)v34 + 2) = v16 + 16;
        *((_WORD *)v34 + 3) = a5;
        v35 = (char *)(v34 + 2);
        goto LABEL_19;
      }
      if( (v33 & 0x400) != 0 && a5 == 1316 )
      {
        LODWORD(v57) = a6;
        v35 = (char *)EtwpReserveWithPebsIndex(v15, 0x524u, v16, BufferHandle, (_LARGE_INTEGER *)&v59[1], v57);
      }
      else
      {
        if( (v33 & 0x800) == 0 )
          goto LABEL_17;
        v50 = 0;
        if( !v15->PmcData->HookIdCount )
          goto LABEL_17;
        while( 1 )
        {
          PmcData = v15->PmcData;
          if( PmcData->HookId[v50] == a5 )
            break;
          if( ++v50 >= PmcData->HookIdCount )
            goto LABEL_17;
        }
        LODWORD(v57) = a6;
        v35 = (char *)EtwpReserveWithPmcCounters(v15, a5, v16, BufferHandle, (_LARGE_INTEGER *)&v59[1], v57);
      }
    }
LABEL_19:
    v60 = v35;
    if( v35 )
    {
      v36 = v35;
      if( a4 )
      {
        while( 1 )
        {
          v37 = *(unsigned int *)(v10 + 8);
          if( (unsigned int)v37 > v16 )
            break;
          memmove(v36, *(const VOID **)v10, v37);
          v36 += v37;
          v16 -= v37;
          ++v7;
          v10 += 16i64;
          if( v7 >= a4 )
          {
            v15 = LoggerContext;
            goto LABEL_24;
          }
        }
        memset(v60, 0i64, Size);
        v15 = LoggerContext;
        EtwpUpdateEventsLostCount(LoggerContext);
      }
LABEL_24:
      if( (v15->LoggerMode & 0x80000) != 0
        && (!(_BYTE)KdDebuggerNotPresent && !KdPitchDebugger || KdEventLoggingPresent) )
      {
        EtwpSendTraceEvent(v15, BufferHandle);
      }
      if( v15->CallbackContext )
        EtwpInvokeEventCallback((INT64)v15, (INT64)BufferHandle, 0i64);
      v38 = *(signed __int64 **)&BufferHandle[2];
      _m_prefetchw(*(const void **)&BufferHandle[2]);
      v39 = *v38;
      v40 = *(_QWORD *)BufferHandle;
      if( ((unsigned __int64)*v38 ^ *(_QWORD *)BufferHandle) >= 0xF )
      {
LABEL_43:
        _InterlockedDecrement((volatile signed __int32 *)(v40 + 12));
      }
      else
      {
        while( 1 )
        {
          v41 = v39;
          v39 = _InterlockedCompareExchange64(*(volatile signed __int64 **)&BufferHandle[2], v39 + 1, v39);
          if( v41 == v39 )
            break;
          v40 = *(_QWORD *)BufferHandle;
          if( ((unsigned __int64)v39 ^ *(_QWORD *)BufferHandle) >= 0xF )
            goto LABEL_43;
        }
      }
      v42 = v15->Flags;
      if( (v42 & 0x80u) != 0 )
      {
        v43 = a5;
        if( _bittest((const signed __int32 *)v15->HookIdMap.Buffer, a5 & 0x1FFF) )
        {
          v44 = a6;
          EtwpStackTraceDispatcher((UINT64)v15, (_LARGE_INTEGER *)&v59[1], 0i64, a6, Flagsa);
          v42 = v15->Flags;
LABEL_32:
          v45 = 0;
          if( (v42 & 0x8000) != 0 )
          {
            v52 = 0;
            if( v15->LbrData->HookIdCount )
            {
              while( 1 )
              {
                LbrData = v15->LbrData;
                if( LbrData->HookId[v52] == v43 )
                  break;
                if( ++v52 >= LbrData->HookIdCount )
                  goto LABEL_33;
              }
              EtwpTraceLastBranchRecord(&v15->LoggerId, &v59[1], 0i64, v44);
            }
          }
LABEL_33:
          if( (v15->Flags & 0x4000000) != 0 && v15->IptData->HookIdCount )
          {
            while( 1 )
            {
              IptData = v15->IptData;
              if( IptData->HookId[v45] == v43 )
                break;
              if( ++v45 >= IptData->HookIdCount )
                goto LABEL_34;
            }
            EtwpTraceProcessorTrace((VOID **)v15, (UINT64)&v59[1]);
          }
          goto LABEL_34;
        }
      }
      else
      {
        v43 = a5;
      }
      v44 = a6;
      goto LABEL_32;
    }
LABEL_34:
    if( v11.DereferenceAndLeave )
    {
      ExReleaseRundownProtectionCacheAwareEx((INT64)a2->EtwpLoggerRundown[v62 / 8], 1i64);
      KeLeaveCriticalRegionThread(KeGetCurrentThread());
    }
  }
}

Referenced by: