IopErrorLogThread

VOID __stdcall IopErrorLogThread(VOID *StartContext){
  __int64 Blink; 
  int v2; 
  unsigned __int16 Length; 
  wchar_t *Buffer; 
  __int16 v5; 
  char v6; 
  VOID **p_P; 
  UINT64 v8; 
  UINT64 v9; 
  _ADAPTER_OBJECT *Flink; 
  _LIST_ENTRY *Entry; 
  _LIST_ENTRY *v12; 
  NTSTATUS v13; 
  const wchar_t *v14; 
  __int16 v15; 
  UINT64 SidLength; 
  _UNICODE_STRING v17; 
  UINT64 PacketSize; 
  _LIST_ENTRY **SidData; 
  _UNICODE_STRING v20; 
  __int64 v21; 
  _UNICODE_STRING DestinationString; 
  _UNICODE_STRING v23; 
  __int16 pszDest[256]; 
  __int16 DeviceName[256]; 
  char P; 

  v17 = 0i64;
  WORD2(SidLength) = 0;
  v20 = 0i64;
  SidData = 0i64;
  DestinationString = 0i64;
  if( *(&stru_140C452E0 + 612) )
  {
    while( 1 )
    {
LABEL_29:
      LODWORD(SidLength) = 0;
      Entry = IopErrorLogGetEntry();
      v12 = Entry;
      if( !Entry )
        return;
      Blink = (__int64)Entry[1].Blink;
      v2 = WORD1(Entry[-1].Blink) - 48;
      v21 = Blink;
      LODWORD(PacketSize) = v2;
      if( Blink )
      {
        RtlInitUnicodeString(&v17, 0i64);
        if( *(_QWORD *)(Blink + 64) )
          v17 = *(_UNICODE_STRING *)(Blink + 56);
        Length = v17.Length;
        if( v17.Length )
        {
LABEL_8:
          Buffer = &v17.Buffer[((unsigned __int64)Length >> 1) - 1];
          if( *Buffer == 92 )
            goto LABEL_12;
          do
          {
            if( Buffer == v17.Buffer )
              break;
            --Buffer;
          }
          while( *Buffer != 92 );
          if( *Buffer == 92 )
LABEL_12:
            ++Buffer;
          v5 = LOWORD(v17.Buffer) - (_WORD)Buffer;
          v17.Buffer = Buffer;
          Length += v5;
          v17.Length = Length;
          goto LABEL_14;
        }
        LODWORD(SidLength) = 0;
        if( ObQueryNameStringMode((VOID *)Blink, (_OBJECT_NAME_INFORMATION *)&v23, 0x110ui64, &SidLength, 0) >= 0
          && (_DWORD)SidLength )
        {
          v17 = v23;
          goto LABEL_41;
        }
        v14 = (const wchar_t *)&dword_1407CF120;
      }
      else
      {
        v14 = L"Application Popup";
      }
      RtlInitUnicodeString(&v17, v14);
LABEL_41:
      Length = v17.Length;
      if( v17.Length )
        goto LABEL_8;
      Buffer = v17.Buffer;
LABEL_14:
      LODWORD(SidLength) = 0;
      v6 = 0;
      p_P = (VOID **)&P;
      v8 = 272i64;
      if( !v12[1].Flink )
        goto LABEL_15;
      while( 1 )
      {
        v13 = ObQueryNameStringMode(v12[1].Flink, (_OBJECT_NAME_INFORMATION *)p_P, v8, &SidLength, 0);
        if( v13 != -1073741820 )
          break;
        if( v6 )
          goto LABEL_15;
        p_P = IopVerifierExAllocatePool_4(1ui64, (unsigned int)SidLength);
        if( !p_P )
          goto LABEL_15;
        v8 = (unsigned int)SidLength;
        v6 = 1;
      }
      v9 = 0i64;
      if( v13 >= 0 && (_DWORD)SidLength )
      {
        v20 = *(_UNICODE_STRING *)p_P;
      }
      else
      {
LABEL_15:
        RtlInitUnicodeString(&v20, (PCWSTR)&dword_1407CF120);
        v9 = 0i64;
      }
      pszDest[0] = 0;
      DeviceName[0] = 0;
      if( Buffer )
        RtlStringCchCopyNW((WCHAR *)pszDest, 0x100ui64, Buffer, (unsigned __int64)Length >> 1);
      if( v20.Buffer )
        RtlStringCchCopyNW((WCHAR *)DeviceName, 0x100ui64, v20.Buffer, (unsigned __int64)v20.Length >> 1);
      if( v6 == 1 )
        ExFreePoolWithTag(p_P, 0);
      if( (unsigned int)(HIDWORD(v12[3].Flink) - 1074004004) <= 1 && !wcsicmp((const wchar_t *)pszDest, L"NTFS") )
      {
        v15 = WORD2(v12[5].Flink);
        WORD1(v12[2].Blink) -= v15;
        WORD2(SidLength) = v15;
        SidData = &v12[7].Blink;
      }
      if( EtwWriteErrorLogEntry(
             v9,
             (_IO_ERROR_LOG_PACKET *)&v12[2].Blink,
             (unsigned int)PacketSize,
             (_LARGE_INTEGER *)&v12[2],
             (PWCHAR)pszDest,
             (PWCHAR)DeviceName,
             WORD2(SidLength),
             SidData) < 0 )
      {
        IopErrorLogRequeueEntry(v12);
        goto LABEL_49;
      }
      _InterlockedExchangeAdd((_DWORD *)&stru_140C452E0 + 246, -WORD1(v12[-1].Blink));
      Flink = (_ADAPTER_OBJECT *)v12[1].Flink;
      if( Flink )
        HalPutDmaAdapter(Flink);
      if( v21 )
        HalPutDmaAdapter((PADAPTER_OBJECT)v12[1].Blink);
      ExFreePoolWithTag(&v12[-1].Blink, 0);
    }
  }
  RtlInitUnicodeString(&DestinationString, L"Eventlog-System");
  if( EtwQueryTraceHandleByLoggerName(&DestinationString, &TraceHandle) >= 0 )
  {
    *(&stru_140C452E0 + 612) = 1;
    goto LABEL_29;
  }
LABEL_49:
  IopErrorLogQueueRequest();
}

Referenced by: