EtwWriteErrorLogEntry

NTSTATUS __stdcall EtwWriteErrorLogEntry(
        UINT64 TraceHandle,
        _IO_ERROR_LOG_PACKET *ErrorLogPacket,
        UINT64 PacketSize,
        _LARGE_INTEGER *EventTimeStamp,
        PWCHAR ProviderName,
        PWCHAR DeviceName,
        UINT16 SidLength,
        PVOID SidData){
  __int16 v8; 
  unsigned int v9; 
  __int64 v11; 
  unsigned __int16 v12; 
  unsigned __int16 v13; 
  unsigned __int8 v14; 
  USHORT EventCategory; 
  __int64 v16; 
  __int64 v17; 
  int v18; 
  unsigned int v19; 
  unsigned int NumberOfStrings; 
  unsigned int v21; 
  __int64 v22; 
  unsigned int v23; 
  unsigned int v24; 
  unsigned __int16 v25; 
  __int64 v26; 
  unsigned int v27; 
  unsigned __int64 v28; 
  UCHAR *v29; 
  UCHAR *v30; 
  __int64 v31; 
  __int64 v32; 
  unsigned int v33; 
  __int64 v34; 
  NTSTATUS result; 
  unsigned __int16 v36; 
  __int16 v37; 
  unsigned int v38; 
  int v39[108]; 
  int v40; 
  __int16 v41; 
  USHORT v42; 
  __int64 v43; 
  __int64 v44; 
  __int64 v45[6]; 
  int v46; 
  int v47; 
  UINT16 *p_SidLength; 
  __int64 v49; 
  PVOID v50; 
  int v51; 
  int v52; 

  v8 = ::TraceHandle;
  v9 = (unsigned int)ErrorLogPacket->ErrorCode >> 30;
  v11 = (unsigned int)PacketSize;
  v12 = 0;
  v13 = 0;
  if( v9 == 1 )
    v14 = 4;
  else
    v14 = (v9 == 2) + 2;
  v41 = v14;
  EventCategory = ErrorLogPacket->EventCategory;
  v45[1] = (__int64)&ErrorLogPacket->ErrorCode;
  v16 = -1i64;
  v42 = EventCategory;
  v17 = -1i64;
  v45[2] = 4i64;
  v40 = 0;
  v43 = 0i64;
  v44 = (__int64)EventTimeStamp;
  v45[0] = 8i64;
  do
    ++v17;
  while( ProviderName[v17] );
  v45[5] = (__int64)ProviderName;
  v18 = (unsigned __int16)(v17 + 1);
  v37 = v18;
  v46 = 2 * v18;
  v45[4] = 2i64;
  v49 = 2i64;
  v19 = 5;
  p_SidLength = &SidLength;
  v45[3] = (__int64)&v37;
  v47 = 0;
  if( SidLength )
  {
    v19 = 6;
    v50 = SidData;
    v51 = SidLength;
    v52 = 0;
  }
  NumberOfStrings = ErrorLogPacket->NumberOfStrings;
  v21 = ErrorLogPacket->DumpDataSize + 40;
  if( v21 > (unsigned int)v11 )
    v21 = v11;
  v38 = v21;
  if( (_WORD)NumberOfStrings && ErrorLogPacket->StringOffset < v21 )
    ErrorLogPacket->StringOffset = v21;
  v22 = 2i64 * v19;
  v36 = 0;
  v23 = v19 + 1;
  v24 = NumberOfStrings;
  ErrorLogPacket->NumberOfStrings = NumberOfStrings + 1;
  v25 = 0;
  v45[v22 - 1] = (__int64)&v36;
  v45[v22] = 2i64;
  v26 = 2i64 * v23;
  v45[2 * v23 - 1] = (__int64)DeviceName;
  do
    ++v16;
  while( DeviceName[v16] );
  HIDWORD(v45[2 * v23]) = 0;
  v27 = v23 + 1;
  LODWORD(v45[v26]) = 2 * (unsigned __int16)(v16 + 1);
  if( v24 )
  {
    v28 = (unsigned __int64)(&ErrorLogPacket->RetryCount + ErrorLogPacket->StringOffset) & 0xFFFFFFFFFFFFFFFEui64;
    v29 = &ErrorLogPacket->MajorFunctionCode + v11;
    do
    {
      v30 = (UCHAR *)(v28 + 2i64 * v13);
      if( v30 >= v29 )
        break;
      if( !*(_WORD *)v30 )
      {
        ++v25;
        v12 = v13 + 1;
        v36 = v25;
      }
      ++v13;
    }
    while( v25 < v24 );
    v31 = 2i64 * v27++;
    v45[v31 - 1] = v28;
    LODWORD(v45[v31]) = 2 * v12;
    HIDWORD(v45[v31]) = 0;
  }
  v32 = 2i64 * v27;
  v36 = v25 + 1;
  v33 = v27 + 1;
  v45[v32 - 1] = (__int64)&v38;
  v45[v32] = 4i64;
  v34 = 2i64 * v33;
  LODWORD(v45[v34]) = v21;
  v45[v34 - 1] = (__int64)ErrorLogPacket;
  HIDWORD(v45[v34]) = 0;
  memset(v39, 0i64, 0x1A8u);
  *(_QWORD *)&v39[98] = EtwpHostSiloState;
  *(_OWORD *)&v39[10] = LegacyEventLogGuid;
  HIWORD(v39[33]) = v8;
  v39[32] = 1;
  LOBYTE(v39[33]) = -1;
  *(__m128i *)&v39[36] = _mm_load_si128((const __m128i *)&_xmm);
  v39[34] = 64;
  result = EtwpEventWriteFull(
             (__int64)v39,
             1u,
             0,
             0,
             (__int64)&v40,
             0,
             4,
             0i64,
             0i64,
             v33 + 1,
             (__int64)&v44,
             0i64,
             0i64,
             0i64,
             0,
             0i64,
             0i64);
  if( result < 0 )
    --ErrorLogPacket->NumberOfStrings;
  return result;
}

Referenced by: