EtwpProviderArrivalCallback

NTSTATUS __stdcall EtwpProviderArrivalCallback(_WMI_LOGGER_CONTEXT *LoggerContext, CHAR Mode, _ETW_REG_ENTRY *RegEntry){
  void *Callback; 
  NTSTATUS v7; 
  NTSTATUS DbgIdForRegEntry; 
  char *v9; 
  NTSTATUS FileNameForAddress; 
  unsigned int v12; 
  _UNICODE_STRING FilePath; 
  char v14[512]; 

  Callback = RegEntry->Callback;
  *(_DWORD *)(&FilePath.MaximumLength + 1) = 0;
  v7 = 0;
  if( !Callback )
    return -1073741503;
  if( (RegEntry->Flags & 0x20) != 0 || (LoggerContext->Flags & 0x2000000) != 0 )
  {
    *(_DWORD *)&FilePath.Length = 0x2000000;
    FilePath.Buffer = (wchar_t *)v14;
    if( Mode )
      FileNameForAddress = MmGetFileNameForAddress(Callback, &FilePath);
    else
      FileNameForAddress = RtlPcToFilePath(Callback, &FilePath);
    v7 = FileNameForAddress;
    if( FileNameForAddress >= 0 )
      EtwpTrackBinaryForSession((INT64)LoggerContext, (UINT8 **)&FilePath, (INT64)&RegEntry->GuidEntry->Guid);
    if( (char *)FilePath.Buffer != v14 )
      ExFreePoolWithTag(FilePath.Buffer, 0);
  }
  if( (RegEntry->Flags & 8) == 0 )
    return v7;
  if( (LoggerContext->LoggerMode & 0x80u) == 0 )
  {
    v12 = 512;
    *(_QWORD *)&FilePath.Length = v14;
    DbgIdForRegEntry = EtwpLocateDbgIdForRegEntry(
                         Mode,
                         (INT64)RegEntry,
                         (_XSTATE_CONFIGURATION *)&FilePath,
                         (_XSTATE_CONFIGURATION *)&v12);
    v9 = *(char **)&FilePath.Length;
    v7 = DbgIdForRegEntry;
    if( DbgIdForRegEntry >= 0 )
    {
      EtwpTrackDebugIdForSession(LoggerContext, *(_QWORD *)&FilePath.Length, v12);
      if( (LoggerContext->LoggerMode & 0x80000) != 0
        && (!(_BYTE)KdDebuggerNotPresent && !KdPitchDebugger || KdEventLoggingPresent) )
      {
        EtwpSendDbgId(LoggerContext);
      }
    }
    if( v9 != v14 )
      ExFreePoolWithTag(v9, 0);
    return v7;
  }
  return -1073741637;
}

Referenced by: