EtwpSavePersistedLogger
__int64 __fastcall EtwpSavePersistedLogger(__int64 a1, __int64 a2, WCHAR a3){
unsigned int *v4;
PVOID v5;
int v6;
unsigned int v7;
_MDL *v8;
unsigned __int64 v9;
__int64 Length;
VOID *v11;
int v12;
_MDL *Mdl;
__int64 v14;
__int64 v15;
__int64 v16;
NTSTATUS v17;
_MDL *v18;
unsigned int v19;
__int64 v20;
unsigned int v21;
unsigned int v22;
_MDL *v23;
__int64 v24;
_QWORD *v25;
unsigned int v26;
__int64 v27;
bool v28;
int v29;
_DWORD *v30;
UINT64 v31;
unsigned int v32;
unsigned int v33;
__int64 v34;
_MDL *v35;
_QWORD *v36;
unsigned int v37;
unsigned int v38;
__int64 v39;
__int64 v40;
_DWORD *v41;
UINT64 v42;
PEVENT_DATA_DESCRIPTOR UserData;
int v45;
char Append[4];
int v47;
unsigned int v48;
unsigned int v49;
unsigned int v50;
unsigned int *v51;
PVOID FileHandle;
unsigned int v53;
PVOID v54;
VOID *MappingAddress;
int v56;
_UNICODE_STRING DestinationString;
_LARGE_INTEGER ByteOffset;
__int64 v59;
_IO_STATUS_BLOCK IoStatusBlock;
INT64 v61[8];
__int128 FileInformation[2];
__int64 v63;
v59 = a2;
v51 = (unsigned int *)a1;
ByteOffset.QuadPart = 0i64;
v4 = (unsigned int *)a1;
v53 = 0;
FileHandle = 0i64;
v63 = 0i64;
v45 = 0;
v49 = 0;
memset(FileInformation, 0, sizeof(FileInformation));
v5 = 0i64;
v6 = 0;
v7 = 0;
v8 = 0i64;
DestinationString = 0i64;
MappingAddress = 0i64;
IoStatusBlock = 0i64;
v54 = 0i64;
RtlInitUnicodeString(&DestinationString, 0i64);
memset(v61, 0i64, sizeof(v61));
EtwWrite(*(&ExBootDevicesRemovedEvent + 241), &ETW_EVENT_SAVE_PERSISTED_LOGGER_START, 0, 0, 0i64);
Length = v4[2];
v56 = Length;
if( !(_DWORD)Length || (Length & 0xFFF) != 0 )
{
v12 = -1072037875;
goto LABEL_59;
}
LODWORD(v11) = MmAllocateMappingAddressEx((unsigned int)Length, 0x4B777445ui64, 0i64);
MappingAddress = v11;
if( !v11 || (Mdl = IoAllocateMdl(0i64, (unsigned int)Length, 0, 0, 0i64), (v8 = Mdl) == 0i64) )
{
v12 = -1073741670;
goto LABEL_59;
}
Mdl->MdlFlags |= 2u;
v12 = EtwpQueryPersistedMemory(v14, a2, &v54, &v53);
if( v12 >= 0 )
{
RtlInitUnicodeString(&DestinationString, (PCWSTR)((char *)v4 + v4[3]));
v15 = 0i64;
v16 = 0i64;
if( v53 )
{
while( 1 )
{
v9 = *((_QWORD *)v54 + v16);
if( v9 < 0x10000000000i64 )
break;
v9 >>= 40;
v16 = (unsigned int)(v16 + 1);
v15 += v9;
if( (unsigned int)v16 >= v53 )
goto LABEL_10;
}
LABEL_25:
v12 = -1072103376;
goto LABEL_59;
}
LABEL_10:
if( v15 << 12 != Length * v4[1] )
goto LABEL_25;
Append[0] = 0;
v17 = EtwpDelayCreate(&FileHandle, &DestinationString, (UINT8 *)Append, 1u, 0, 1u);
v5 = FileHandle;
v12 = v17;
if( v17 < 0 )
goto LABEL_59;
LODWORD(v63) = 0x2000;
LODWORD(UserData) = 4;
ZwSetInformationFile(
(UINT64)FileHandle,
(UINT64)&IoStatusBlock,
(INT8 *)FileInformation,
0x28ui64,
(UINT64)UserData);
v12 = EtwpInitializeCompressedWriter((INT64)v61, (unsigned int)Length, (INT64)v5);
if( v12 < 0 )
goto LABEL_59;
v18 = v8 + 1;
v19 = 0;
v47 = 0;
v48 = 0;
if( !v51[1] )
goto LABEL_44;
v20 = (__int64)v51;
v21 = (unsigned int)Length >> 12;
v50 = (unsigned int)Length >> 12;
while( 1 )
{
if( v21 )
{
v22 = v47;
v23 = v18;
v24 = v21;
do
{
v25 = v54;
v26 = v19 + 1;
v23->Next = (_MDL *)(v19 + (*((_QWORD *)v54 + v22) & 0xFFFFFFFFFFi64));
v19 = 0;
v23 = (_MDL *)((char *)v23 + 8);
v27 = v25[v22] >> 40;
v28 = v26 == v27;
if( v26 != v27 )
v19 = v26;
v29 = v22 + 1;
if( !v28 )
v29 = v22;
v22 = v29;
--v24;
}
while( v24 );
LODWORD(Length) = v56;
v20 = (__int64)v51;
v47 = v29;
v48 = v19;
}
v30 = MmMapLockedPagesWithReservedMapping(MappingAddress, 0x4B777445ui64, v8, MmCached);
v31 = (UINT64)v30;
if( *v30 != (_DWORD)Length )
goto LABEL_24;
v32 = v30[2] <= *v30 ? v30[2] : v30[1];
*(_DWORD *)(v31 + 48) = v32;
if( v32 > (unsigned int)Length )
break;
if( v32 > 0x48 )
{
if( (_DWORD)Length != v32 )
memset((VOID *)(v31 + v32), 255i64, Length - v32);
if( v7 )
v12 = EtwpWriteBufferCompressed((INT64)v61, (UINT8 *)v31);
else
v61[1] += (unsigned int)Length;
}
v6 = v45;
LABEL_38:
MmUnmapReservedMapping(v31, 0x4B777445ui64, (INT64)v8);
if( v12 < 0 && !v7 )
{
v7 = v49;
v5 = FileHandle;
v4 = v51;
goto LABEL_59;
}
v19 = v48;
if( ++v7 >= *(_DWORD *)(v20 + 4) )
{
v5 = FileHandle;
LABEL_44:
EtwpWriteRemainingCompressedData((__int64)v61, &v49, &v45);
v33 = 0;
if( (unsigned int)Length >> 12 )
{
v34 = (unsigned int)Length >> 12;
v35 = v8 + 1;
do
{
v36 = v54;
v37 = v19 + 1;
v38 = v33 + 1;
v35->Next = (_MDL *)(v19 + (*((_QWORD *)v54 + v33) & 0xFFFFFFFFFFi64));
v35 = (_MDL *)((char *)v35 + 8);
v39 = v36[v33] >> 40;
v40 = v19 + 1;
if( v40 != v39 )
v38 = v33;
v19 = 0;
v33 = v38;
if( v40 != v39 )
v19 = v37;
--v34;
}
while( v34 );
v5 = FileHandle;
}
v41 = MmMapLockedPagesWithReservedMapping(MappingAddress, 0x4B777445ui64, v8, MmCached);
v7 = v49;
v42 = (UINT64)v41;
v6 = v45;
v41[34] |= 0x4000000u;
v28 = v41[37] == 4;
v41[11] = 3;
v50 = v7 + 1;
v41[35] = v7 + 1;
if( v28 )
v41[93] += v6;
else
v41[95] += v6;
v12 = ZwWriteFile((_HANDLE)v5, 0, 0i64, 0i64, &IoStatusBlock, v41, Length, &ByteOffset, 0i64);
MmUnmapReservedMapping(v42, 0x4B777445ui64, (INT64)v8);
v4 = v51;
if( v12 >= 0 )
v7 = v50;
else
++v6;
goto LABEL_59;
}
v21 = v50;
v18 = v8 + 1;
}
v6 = v45;
LABEL_24:
++v6;
v12 = -1073741306;
v45 = v6;
goto LABEL_38;
}
LABEL_59:
if( v61[4] )
{
ExFreePoolWithTag((PVOID)v61[4], 0);
v61[4] = 0i64;
}
if( v61[5] )
{
ExFreePoolWithTag((PVOID)v61[5], 0);
v61[5] = 0i64;
}
if( v5 )
ZwClose((_HANDLE)v5);
if( MappingAddress )
MmFreeMappingAddress(MappingAddress, 0x4B777445u);
if( v8 )
ExFreePoolWithTag(v8, 0);
if( v54 )
ExFreePoolWithTag(v54, 0);
LOBYTE(v9) = 1;
KsrFreePersistedMemoryBlock(EtwpKsrGuid, v59, v9);
LODWORD(UserData) = v6;
EtwpTraceSavePersistedLoggerStop(&DestinationString, (unsigned int)Length, v4[1], v7, (INT64)UserData);
return(unsigned int)v12;
}Referenced by:
EtwpSavePersistedLoggersWorker