EtwpWriteUserEvent
__int64 __fastcall EtwpWriteUserEvent(
__int64 a1,
char a2,
unsigned __int16 a3,
char a4,
char a5,
__int64 a6,
__int64 a7,
char a8,
UINT64 Keyword,
int a10,
__int64 a11,
__int64 a12,
__int64 a13,
__int16 a14,
__int64 a15,
__int64 a16){
_ETW_GUID_ENTRY *v19;
unsigned int v20;
_KSPIN_LOCK *v21;
__int16 v22;
unsigned __int8 v23;
bool v24;
__int64 v25;
__int64 v26;
_ETW_GUID_ENTRY *v27;
_TRACE_ENABLE_INFO *v28;
int v29;
UINT64 v30;
unsigned __int8 v31;
unsigned int v32;
_EPROCESS *Process;
_ETW_FILTER_HEADER *FilterData;
unsigned __int64 v35;
unsigned int v36;
__int64 v37;
__int64 v38;
__int64 v39;
unsigned int **v41;
__int64 v42;
int v43;
unsigned int v44;
unsigned int EnableProperty;
unsigned int LoggerId;
_OWORD *v47;
unsigned __int64 v48;
__int64 v49;
unsigned int v50;
unsigned int v51;
unsigned __int64 v52;
unsigned int v53;
char v54;
__int64 v55;
_WMI_LOGGER_CONTEXT *v56;
char v57;
_WORD *v58;
__int64 v59;
_WMI_LOGGER_CONTEXT *v60;
unsigned int v61;
unsigned __int16 *v62;
_OWORD *v63;
__int128 v64;
unsigned int v65;
unsigned __int16 *v66;
int Size;
__int64 v68;
UINT64 ProcessStartKey;
__int64 v70;
__int64 v71;
UINT64 v72;
size_t v73;
unsigned __int16 *v74;
unsigned __int16 v75;
unsigned __int16 v76;
_WORD *v77;
__int64 v78;
unsigned __int16 *v79;
char *v80;
unsigned int v81;
__int16 v82;
__int64 v83;
_LARGE_INTEGER *v84;
int v85;
unsigned int v86;
int v87;
int v88;
unsigned __int16 *v89;
__int64 v90;
unsigned __int16 v91;
char *v92;
__int64 v93;
__int64 v94;
__int64 v95;
__int16 v96;
unsigned __int16 v97;
__int64 v98;
unsigned __int16 *v99;
unsigned __int16 *v100;
unsigned __int16 *v101;
unsigned __int16 *v102;
_ETHREAD *v103;
_WMI_LOGGER_CONTEXT *v104;
_WMI_LOGGER_CONTEXT *v105;
int ReserveTraceBufferStatus;
_ETW_GUID_ENTRY *v107;
_ETW_FILTER_HEADER *v108;
int FilterFlags;
char v110;
char v111;
char v112;
void *v113;
void *v114;
unsigned __int16 *p_PsmKeyItem;
int v116;
char v117;
_ETWP_HEADER_EXTENDED_DATA_ITEM PsmKeyItem;
UINT64 Flags;
char v120;
unsigned __int8 v121;
int RequiredSize;
int RequiredSize_4;
__int16 v124;
int v125;
unsigned __int16 v126;
char v127;
unsigned __int16 v128;
unsigned __int16 *v129;
int v130;
__int64 v131;
__int64 v132;
unsigned __int16 v133;
_WMI_LOGGER_CONTEXT *LoggerContext;
_WORD *v135;
unsigned __int16 *v136;
VOID *Src;
unsigned __int64 v138;
char v139;
char PreviousMode;
unsigned int LoggerIndex;
unsigned int LoggerIndex_4;
_LARGE_INTEGER TimeStamp;
__int64 v144;
unsigned int v145;
unsigned int v146;
unsigned int v147;
VOID *v148;
UINT64 EventKey;
VOID *v150;
_ETHREAD *Thread;
_ETW_GUID_ENTRY *GuidEntry;
UINT64 HighLimit;
UINT64 LowLimit;
UINT64 v155;
UINT64 v156;
UINT16 *v157;
_ETW_SILODRIVERSTATE *EtwSiloState;
UINT64 *v159;
UINT16 *v160;
char *v161;
__int64 v162;
__int64 v163;
__int64 v164;
_ETW_BUFFER_HANDLE BufferHandle[4];
__int64 v166;
_ETHREAD *v167;
_ETHREAD *CurrentThread;
_ETHREAD *v169;
_OWORD v170[25];
_ETW_SID_EXTENDED_DATA_ITEM SidItem;
v133 = a3;
v132 = a1;
v19 = (_ETW_GUID_ENTRY *)a13;
v164 = a1;
v131 = a6;
v138 = a11;
v162 = a12;
v160 = (UINT16 *)a15;
v159 = (UINT64 *)a16;
v20 = 0;
v125 = 0;
memset(v170, 0i64, 0x188u);
LoggerIndex = 0;
memset(&SidItem, 0i64, sizeof(SidItem));
Src = 0i64;
v150 = 0i64;
v128 = 0;
v157 = 0i64;
EventKey = 0i64;
EtwSiloState = PsGetCurrentServerSiloGlobals(v21)->EtwSiloState;
v22 = a14 & 0x200;
v124 = a14 & 0x200;
if( a11 )
{
if( !a10 )
return 3221225485i64;
}
else if( a10 )
{
return 3221225485i64;
}
if( (unsigned int)a10 > 0x80 )
return 3221225485i64;
if( !a13 )
v19 = (_ETW_GUID_ENTRY *)a1;
GuidEntry = v19;
v120 = 0;
v144 = *(_QWORD *)(a1 + 392);
v163 = v144;
if( v159 && *v159 )
{
EventKey = *v159;
v120 = 16;
}
DecodeProviderTraits(v160, (a14 & 0x400) != 0, &v128, &v157);
Thread = (_ETHREAD *)KeGetCurrentThread();
--Thread->Tcb.KernelApcDisable;
v23 = ~a4 & a2;
while( 1 )
{
LABEL_10:
v24 = !_BitScanForward((unsigned int *)&v25, v23);
LoggerIndex = v25;
if( v24 )
{
v37 = v144;
LABEL_21:
v38 = v132;
v39 = v131;
goto LABEL_22;
}
LoggerContext = (_WMI_LOGGER_CONTEXT *)1;
*(_OWORD *)BufferHandle = 0i64;
v166 = 0i64;
TimeStamp.QuadPart = 0i64;
RequiredSize = 80;
LoggerIndex_4 = 0;
v127 = 0;
v126 = 0;
v130 = 0;
v148 = 0i64;
v161 = 0i64;
v23 &= v23 - 1;
v121 = v23;
v26 = (unsigned int)v25;
v27 = GuidEntry;
v28 = &GuidEntry->EnableInfo[v25];
if( v162 )
{
v29 = *(_DWORD *)(v162 + 4i64 * (v28->LoggerId >> 5));
if( _bittest(&v29, v28->LoggerId & 0x1F) )
continue;
}
if( !EtwpLevelKeywordEnabled(v28, a8, Keyword) )
continue;
Process = KeGetCurrentThread()->ApcState.Process;
if( ((a5 & 2) != 0 || Process->$4E3DFAFA17165B33969DFF4E60E4EB31::_bf_0 < 0) && (v28->EnableProperty & 0x200) != 0 )
continue;
FilterData = v27->FilterData;
if( FilterData
&& ((FilterData[v26].FilterFlags & 0x80000200) == -2147483136
|| (FilterData[v26].FilterFlags & 0x80000100) == -2147483392) )
{
v35 = v138;
v36 = LoggerIndex;
if( !EtwpApplyEventIdPayloadFilterOnUserEvent((__int64)v27, LoggerIndex, v133, v131, v32, v138) )
goto LABEL_19;
v32 = a10;
v30 = Keyword;
v31 = a8;
}
else
{
v36 = LoggerIndex;
v35 = v138;
}
if( v22 )
{
LOBYTE(Flags) = 0;
if( EtwpIsEventNameFilterEnabled(v27, v36, v31, v30) )
{
if( !EtwpApplyEventNameFilter((__int64)v27, v36, v32, v35, 1, 0, a8, v42, 0) )
{
LABEL_19:
v23 = v121;
continue;
}
v32 = a10;
}
}
v43 = 0;
if( a7 )
{
v44 = 104;
RequiredSize = 104;
v43 = 8;
}
else
{
v44 = RequiredSize;
}
EnableProperty = v28->EnableProperty;
if( (EnableProperty & 0xFFFFFF9F) != 0 )
{
if( (EnableProperty & 0x800) != 0 && EtwSiloState != (_ETW_SILODRIVERSTATE *)EtwpHostSiloState )
{
v43 |= 0x80u;
v44 += (EtwSiloState->PartitionNameSize + 15) & 0xFFFFFFF8;
RequiredSize = v44;
}
if( (EnableProperty & 1) != 0 )
{
if( (v120 & 2) == 0 )
{
EtwpGetSidExtendedHeaderItem(&SidItem);
v120 |= 2u;
EnableProperty = v28->EnableProperty;
v32 = a10;
}
v43 |= 2u;
v44 += SidItem.Header.Size;
RequiredSize = v44;
}
if( (EnableProperty & 2) != 0 )
{
v43 |= 1u;
v44 += 16;
RequiredSize = v44;
}
if( (EnableProperty & 0x80u) != 0 )
{
v43 |= 0x20u;
v44 += 16;
RequiredSize = v44;
}
if( (EnableProperty & 0x100) != 0 )
{
v43 |= 0x40u;
v44 += 16;
RequiredSize = v44;
}
if( (EnableProperty & 4) == 0 )
goto LABEL_47;
v107 = GuidEntry;
v108 = GuidEntry->FilterData;
if( !v108 )
goto LABEL_197;
FilterFlags = v108[v26].FilterFlags;
if( (FilterFlags & 0x80001000) != -2147479552
&& (FilterFlags & 0x80002000) != -2147475456
&& (FilterFlags & 0x80004000) != -2147467264 )
{
goto LABEL_197;
}
LOBYTE(Flags) = 1;
EtwpApplyLevelKwFilter((_WMI_LOGGER_CONTEXT *)GuidEntry);
if( v110 && EtwpApplyStackWalkFilterOnUserEvent(v131, (INT64)v107, v36) )
{
v111 = EtwpApplyEventNameFilter((__int64)v107, v36, a10, v138, 1, 0, a8, Keyword, 1);
v32 = a10;
if( v111 )
{
LABEL_197:
v112 = v120;
if( (v120 & 1) == 0 )
{
Src = EtwpGetStackLookasideListEntry();
if( Src )
{
EtwpGetStackExtendedHeaderItem(Thread, 0i64, 0x100ui64, (_ETWP_HEADER_EXTENDED_DATA_ITEM **)&Src, 0, 0i64);
v120 = (Src != 0i64 ? 8 : 0) | v112 & 0xF7;
}
else
{
HighLimit = 0i64;
LowLimit = 0i64;
IoGetStackLimits(&LowLimit, &HighLimit);
if( (unsigned __int64)&HighLimit - LowLimit > 0x1440 )
{
v113 = alloca(1552i64);
Src = &v117;
EtwpGetStackExtendedHeaderItem(
Thread,
0i64,
0xC0ui64,
(_ETWP_HEADER_EXTENDED_DATA_ITEM **)&Src,
0,
0i64);
}
}
v120 |= 1u;
v32 = a10;
}
if( Src )
{
v43 |= 4u;
v44 += *(unsigned __int16 *)Src;
RequiredSize = v44;
}
}
}
else
{
v32 = a10;
}
LABEL_47:
if( (v28->EnableProperty & 8) != 0 )
{
if( (v120 & 4) != 0 )
{
p_PsmKeyItem = (unsigned __int16 *)v150;
}
else
{
v155 = 0i64;
v156 = 0i64;
IoGetStackLimits(&v156, &v155);
if( (unsigned __int64)&v155 - v156 <= 0x1E0 )
{
p_PsmKeyItem = (unsigned __int16 *)v150;
}
else
{
v114 = alloca(480i64);
p_PsmKeyItem = (unsigned __int16 *)&PsmKeyItem;
v150 = &PsmKeyItem;
EtwpGetPsmKeyExtendedHeaderItem(&PsmKeyItem);
}
v120 |= 4u;
v32 = a10;
}
if( p_PsmKeyItem )
{
v43 |= 0x10u;
v44 += *p_PsmKeyItem;
RequiredSize = v44;
}
}
}
LoggerId = v28->LoggerId;
v147 = LoggerId;
v47 = &v170[3 * LODWORD(v170[24])];
if( v32 )
break;
LABEL_72:
if( v130 )
{
v44 += (v126 + 15) & 0xFFFFFFF8;
RequiredSize = v44;
}
if( v128 )
{
v44 += (v128 + 15) & 0xFFFFFFF8;
RequiredSize = v44;
}
*((_DWORD *)v47 + 10) = v44;
v55 = 8i64 * LoggerId;
v37 = v144;
if( ExAcquireRundownProtectionCacheAwareEx(*(_QWORD *)(*(_QWORD *)(v144 + 448) + v55), 1i64) )
{
if( LoggerId >= *(_DWORD *)(v37 + 16) )
{
v56 = (_WMI_LOGGER_CONTEXT *)1;
}
else
{
_mm_lfence();
v56 = *(_WMI_LOGGER_CONTEXT **)(v55 + *(_QWORD *)(v37 + 456));
v44 = RequiredSize;
}
LoggerContext = v56;
v57 = 1;
}
else
{
v57 = v127;
v56 = LoggerContext;
}
if( ((unsigned __int8)v56 & 1) != 0 )
{
if( v57 )
ExReleaseRundownProtectionCacheAwareEx(*(_QWORD *)(*(_QWORD *)(v37 + 448) + 8i64 * LoggerId), 1i64);
v24 = LoggerId == 3;
v22 = v124;
v23 = v121;
if( v24 )
{
v116 = -1073741058;
if( !*(_DWORD *)(v37 + 4068) )
v116 = -1073741816;
v125 = v116;
goto LABEL_21;
}
}
else
{
LODWORD(Flags) = 0;
v58 = EtwpReserveTraceBuffer(v56, v44, BufferHandle, &TimeStamp, Flags);
v59 = (__int64)v58;
v135 = v58;
if( v58 )
{
v60 = LoggerContext;
*(_QWORD *)v47 = LoggerContext;
*((_QWORD *)v47 + 1) = v58;
v47[1] = *(_OWORD *)BufferHandle;
*((_QWORD *)v47 + 4) = v166;
++LODWORD(v170[24]);
v146 = 0;
v61 = 80;
LODWORD(v129) = 80;
RequiredSize_4 = 80;
v62 = 0i64;
v136 = 0i64;
v63 = (_OWORD *)v131;
*(_OWORD *)v59 = *(_OWORD *)v131;
*(_OWORD *)(v59 + 16) = v63[1];
*(_OWORD *)(v59 + 32) = v63[2];
*(_OWORD *)(v59 + 48) = v63[3];
*(_OWORD *)(v59 + 64) = v63[4];
if( v157 )
{
v64 = *(_OWORD *)v157;
*(_WORD *)(v59 + 4) |= 0x80u;
}
else
{
v64 = *(_OWORD *)(v132 + 40);
}
*(_OWORD *)(v59 + 24) = v64;
*(_DWORD *)v59 = v44 | v60->EventMarker[v133];
v65 = 80;
if( v43 )
{
if( (v43 & 0x80u) != 0 )
{
v62 = (unsigned __int16 *)(v59 + 80);
v95 = (__int64)EtwSiloState;
v96 = (EtwSiloState->PartitionNameSize + 15) & 0xFFF8;
*(_WORD *)(v59 + 80) = v96;
*(_WORD *)(v59 + 82) = 16;
*(_WORD *)(v59 + 86) = *(_WORD *)(v95 + 4200);
*(_WORD *)(v59 + 84) &= ~1u;
*(_WORD *)(v59 + 84) &= 1u;
v97 = v96 - *(_WORD *)(v95 + 4200) - 8;
v98 = v59 + 88;
memmove((VOID *)(v59 + 88), *(const VOID **)(v95 + 4192), *(unsigned __int16 *)(v95 + 4200));
memset((VOID *)(v98 + *(unsigned __int16 *)(v95 + 4200)), 0i64, v97);
v59 = (__int64)v135;
v135[2] |= 1u;
v61 = *v62 + 80;
LODWORD(v129) = v61;
RequiredSize_4 = v61;
v136 = v62;
v65 = v61;
}
if( (v43 & 8) != 0 )
{
v94 = v59 + v65;
*(_DWORD *)v94 = 65560;
*(_WORD *)(v94 + 6) = 16;
*(_WORD *)(v94 + 4) &= ~1u;
*(_WORD *)(v94 + 4) &= 1u;
*(_OWORD *)(v94 + 8) = *(_OWORD *)a7;
*(_WORD *)(v59 + 4) |= 1u;
v61 = v65 + 24;
LODWORD(v129) = v65 + 24;
RequiredSize_4 = v65 + 24;
if( v62 )
v62[2] |= 1u;
v62 = (unsigned __int16 *)(v59 + v65);
v136 = v62;
v65 += 24;
}
if( (v43 & 2) != 0 )
{
v66 = (unsigned __int16 *)(v59 + v65);
Size = SidItem.Header.Size;
memmove(v66, &SidItem, SidItem.Header.Size);
v59 = (__int64)v135;
v135[2] |= 1u;
v61 = Size + v65;
LODWORD(v129) = Size + v65;
RequiredSize_4 = Size + v65;
if( v62 )
v62[2] |= 1u;
v62 = v66;
v136 = v66;
v65 += Size;
}
if( (v43 & 1) != 0 )
{
v93 = v59 + v65;
*(_DWORD *)v93 = 196624;
*(_WORD *)(v93 + 6) = 4;
*(_WORD *)(v93 + 4) &= ~1u;
*(_WORD *)(v93 + 4) &= 1u;
*(_DWORD *)(v93 + 8) = PsGetCurrentProcessSessionId();
v59 = (__int64)v135;
v135[2] |= 1u;
v61 = v65 + 16;
LODWORD(v129) = v65 + 16;
RequiredSize_4 = v65 + 16;
if( v62 )
v62[2] |= 1u;
v62 = (unsigned __int16 *)v93;
v136 = (unsigned __int16 *)v93;
v65 += 16;
}
if( (v43 & 0x20) != 0 )
{
v68 = v59 + v65;
*(_DWORD *)v68 = 851984;
*(_WORD *)(v68 + 6) = 8;
*(_WORD *)(v68 + 4) &= ~1u;
*(_WORD *)(v68 + 4) &= 1u;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
ProcessStartKey = PsGetProcessStartKey((INT64)CurrentThread->Tcb.ApcState.Process);
*(_QWORD *)(v70 + 8) = ProcessStartKey;
*(_WORD *)(v59 + 4) |= 1u;
v61 = v65 + 16;
LODWORD(v129) = v65 + 16;
RequiredSize_4 = v65 + 16;
if( v62 )
v62[2] |= 1u;
v62 = (unsigned __int16 *)v70;
v136 = (unsigned __int16 *)v70;
v65 += 16;
v44 = RequiredSize;
}
if( (v43 & 0x40) != 0 )
{
v71 = v59 + v65;
*(_DWORD *)v71 = 655376;
*(_WORD *)(v71 + 6) = 8;
*(_WORD *)(v71 + 4) &= ~1u;
*(_WORD *)(v71 + 4) &= 1u;
if( (v120 & 0x10) != 0 || (EtwpCreateEventKey(&EventKey), v120 |= 0x10u, !v159) )
{
v72 = EventKey;
}
else
{
v72 = EventKey;
*v159 = EventKey;
}
*(_QWORD *)(v71 + 8) = v72;
*(_WORD *)(v59 + 4) |= 1u;
v61 = v65 + 16;
LODWORD(v129) = v65 + 16;
RequiredSize_4 = v65 + 16;
if( v62 )
v62[2] |= 1u;
v62 = (unsigned __int16 *)v71;
v136 = (unsigned __int16 *)v71;
v65 += 16;
}
if( (v43 & 4) != 0 )
{
v99 = (unsigned __int16 *)(v59 + v65);
v100 = (unsigned __int16 *)Src;
memmove(v99, Src, *(unsigned __int16 *)Src);
v59 = (__int64)v135;
v135[2] |= 1u;
v61 = v65 + *v100;
LODWORD(v129) = v61;
v65 = v61;
RequiredSize_4 = v61;
if( v62 )
v62[2] |= 1u;
v62 = v99;
v136 = v99;
}
if( (v43 & 0x10) != 0 )
{
v101 = (unsigned __int16 *)(v59 + v65);
v102 = (unsigned __int16 *)v150;
memmove(v101, v150, *(unsigned __int16 *)v150);
v59 = (__int64)v135;
v135[2] |= 1u;
v61 = v65 + *v102;
LODWORD(v129) = v61;
v65 = v61;
RequiredSize_4 = v61;
if( v62 )
v62[2] |= 1u;
v62 = v101;
v136 = v101;
}
}
v73 = v128;
if( v128 )
{
v74 = (unsigned __int16 *)(v59 + v65);
v129 = v74;
v75 = (v128 + 15) & 0xFFF8;
*v74 = v75;
v74[1] = 12;
v74[3] = v73;
v74[2] &= ~1u;
v74[2] &= 1u;
v76 = v75 - v73 - 8;
v77 = v74 + 4;
v78 = v73;
memmove(v74 + 4, v160, v73);
memset((char *)v77 + v78, 0i64, v76);
v59 = (__int64)v135;
v135[2] |= 1u;
v79 = v129;
v61 = v65 + *v129;
LODWORD(v129) = v61;
v65 = v61;
RequiredSize_4 = v61;
if( v62 )
v62[2] |= 1u;
v62 = v79;
v136 = v79;
}
if( v130 )
{
v89 = (unsigned __int16 *)(v59 + v65);
v90 = v126;
v91 = (v126 + 15) & 0xFFF8;
*v89 = v91;
v89[1] = 11;
v89[3] = v90;
v89[2] &= ~1u;
v89[2] &= 1u;
v80 = (char *)(v89 + 4);
v148 = v89 + 4;
v161 = (char *)v89 + v90 + 8;
memset(v161, 0i64, (unsigned __int16)(v91 - v90 - 8));
v59 = (__int64)v135;
v135[2] |= 1u;
v61 = v65 + *v89;
LODWORD(v129) = v61;
RequiredSize_4 = v61;
if( v62 )
v62[2] |= 1u;
}
else
{
v80 = (char *)v148;
}
v81 = 0;
v82 = v124;
while( 1 )
{
while( 1 )
{
v146 = v81;
if( v81 >= a10 )
{
if( v162 )
*(_DWORD *)(v162 + 4i64 * (v147 >> 5)) |= 1 << (v147 & 0x1F);
*(_LARGE_INTEGER *)(v59 + 16) = TimeStamp;
v103 = Thread;
*(_DWORD *)(v59 + 56) = Thread->Tcb.SchedulerApc.SpareLong0;
*(_DWORD *)(v59 + 60) = v103->Tcb.UserTime;
*(_DWORD *)(v59 + 8) = v103->Cid.UniqueThread;
*(_DWORD *)(v59 + 12) = v103->Cid.UniqueProcess;
v104 = LoggerContext;
if( (LoggerContext->LoggerMode & 0x80000) != 0
&& (!(_BYTE)KdDebuggerNotPresent && !KdPitchDebugger || KdEventLoggingPresent) )
{
EtwpSendTraceEvent(LoggerContext, BufferHandle);
}
v22 = v82;
v23 = v121;
if( v104->CallbackContext )
EtwpInvokeEventCallback((INT64)v104, (INT64)BufferHandle, v132 + 40);
goto LABEL_10;
}
v83 = *(unsigned int *)(v138 + 16i64 * v81 + 8);
v84 = *(_LARGE_INTEGER **)(v138 + 16i64 * v81);
if( v82 )
{
LOBYTE(v85) = *(_BYTE *)(v138 + 16i64 * v81 + 12);
v44 = RequiredSize;
v80 = (char *)v148;
v61 = RequiredSize_4;
LODWORD(v129) = RequiredSize_4;
}
else
{
LOBYTE(v85) = 0;
}
v85 = (unsigned __int8)v85;
if( (_BYTE)v85 )
break;
v86 = v83 + v61;
if( (unsigned int)v83 + v61 < v61 )
{
RequiredSize_4 = -1;
v87 = -1073741675;
v86 = -1;
}
else
{
RequiredSize_4 = v83 + v61;
v87 = 0;
}
if( v87 || v86 > v44 )
{
LABEL_167:
v125 = -1073741820;
*(_DWORD *)v59 = v44 | LoggerContext->ErrorMarker;
*(_LARGE_INTEGER *)(v59 + 16) = TimeStamp;
v23 = v121;
v38 = v132;
v37 = v144;
v39 = v131;
goto LABEL_22;
}
v169 = (_ETHREAD *)KeGetCurrentThread();
PreviousMode = v169->Tcb.PreviousMode;
if( PreviousMode
&& (_DWORD)v83
&& ((unsigned __int64)v84 + v83 > 0x7FFFFFFF0000i64 || (_LARGE_INTEGER *)((char *)v84 + v83) < v84) )
{
MEMORY[0x7FFFFFFF0000] = 0;
}
memmove((VOID *)(v59 + v61), v84, v83);
v44 = RequiredSize;
v80 = (char *)v148;
v61 = RequiredSize_4;
LODWORD(v129) = RequiredSize_4;
LABEL_126:
++v81;
v59 = (__int64)v135;
}
v88 = v85 - 1;
if( v88 )
{
if( v88 == 2 )
{
if( (_DWORD)v83 == 8 )
{
if( (unsigned __int64)&v84[1] > 0x7FFFFFFF0000i64 || &v84[1] < v84 )
MEMORY[0x7FFFFFFF0000] = 0;
TimeStamp = *v84;
}
goto LABEL_126;
}
++v81;
v59 = (__int64)v135;
}
else
{
if( !v80 )
goto LABEL_167;
v92 = &v80[v83];
if( &v80[v83] < v80 || v92 > v161 || !v130 )
goto LABEL_167;
if( (_DWORD)v83
&& ((unsigned __int64)v84 + v83 > 0x7FFFFFFF0000i64 || (_LARGE_INTEGER *)((char *)v84 + v83) < v84) )
{
MEMORY[0x7FFFFFFF0000] = 0;
}
memmove(v80, v84, v83);
v80 = v92;
v148 = v92;
--v130;
v61 = (unsigned int)v129;
++v81;
v59 = (__int64)v135;
}
}
}
v105 = LoggerContext;
ReserveTraceBufferStatus = EtwpGetReserveTraceBufferStatus(LoggerContext, v44);
if( EtwEventEnabled(*(&ExBootDevicesRemovedEvent + 241), &ETW_EVENT_LOST_EVENT) )
EtwpTraceLostEvent(
(_QWORD *)(v132 + 40),
(__int16 *)(v131 + 40),
&v105->LoggerName.Length,
ReserveTraceBufferStatus);
if( v125 >= 0 && (v105->LoggerMode & 0x8000000) == 0 )
v125 = ReserveTraceBufferStatus;
ExReleaseRundownProtectionCacheAwareEx(*(_QWORD *)(*(_QWORD *)(v37 + 448) + 8i64 * LoggerId), 1i64);
v22 = v124;
v23 = v121;
if( ReserveTraceBufferStatus == -1073741675 )
{
v125 = -1073741675;
goto LABEL_21;
}
}
}
v145 = 0;
v167 = (_ETHREAD *)KeGetCurrentThread();
v139 = v167->Tcb.PreviousMode;
v48 = v138;
if( v139 )
{
v49 = 16i64 * v32;
if( v49 )
{
if( (v138 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( v138 + v49 > 0x7FFFFFFF0000i64 || v138 + v49 < v138 )
MEMORY[0x7FFFFFFF0000] = 0;
}
}
v50 = 0;
v44 = RequiredSize;
while( 1 )
{
v145 = v50;
if( v50 >= v32 )
{
LoggerId = v147;
goto LABEL_72;
}
v51 = v44;
v52 = 16i64 * v50 + v48;
LoggerIndex_4 = *(_DWORD *)(v52 + 8);
v53 = LoggerIndex_4;
if( LoggerIndex_4 > 0xFFFF )
{
v125 = -2147483643;
v23 = v121;
v38 = v132;
v37 = v144;
v39 = v131;
goto LABEL_22;
}
if( v124 )
{
v54 = *(_BYTE *)(v52 + 12);
v53 = LoggerIndex_4;
}
else
{
v54 = 0;
}
if( v54 )
{
if( v54 == 1 )
{
v126 += v53;
++v130;
}
v44 = RequiredSize;
}
else
{
v44 = v53 + RequiredSize;
RequiredSize += v53;
}
if( v44 < v51 )
break;
++v50;
v48 = v138;
}
v125 = -2147483643;
v23 = v121;
v38 = v132;
v37 = v144;
v39 = v131;
LABEL_22:
if( (v120 & 8) != 0 )
{
RtlpInterlockedPushEntrySList(&xmmword_140C53A90, (PSLIST_ENTRY)Src - 1);
v38 = v132;
v39 = v131;
}
if( v125 < 0 )
{
EtwpFailLogging(a8, Keyword, v38, (__int64)v170, v23, v125, (__int16 *)(v39 + 40), 1);
}
else
{
while( v20 < LODWORD(v170[24]) )
{
EtwpReleaseTraceBuffer((_ETW_BUFFER_HANDLE *)&v170[3 * v20 + 1]);
ExReleaseRundownProtectionCacheAwareEx(*(_QWORD *)(*(_QWORD *)(v37 + 448) + 8i64 * **v41), 1i64);
++v20;
}
}
KeLeaveCriticalRegionThread(&Thread->Tcb);
return(unsigned int)v125;
}Referenced by:
NtTraceEvent