EtwWriteString

NTSTATUS __stdcall EtwWriteString(UINT64 RegHandle, UINT8 Level, UINT64 Keyword, _GUID *ActivityId, WCHAR *String){
  unsigned int v8; 
  UINT64 v9; 
  __int64 v11; 
  __int64 v12; 
  __int64 v13; 
  char v14; 
  unsigned __int8 v15; 
  __int64 v16; 
  unsigned __int8 v17; 
  __int64 v18; 
  __int64 v19; 
  char v20; 
  unsigned __int8 v21; 
  __int64 v22; 
  __int64 v23; 
  __int64 v24; 
  __int64 v25; 
  int v26; 
  int v27; 
  __int64 v28[2]; 
  __int64 v29[2]; 
  __int128 v30; 

  v24 = 0i64;
  v8 = 0;
  *(_OWORD *)v29 = 0i64;
  v30 = 0i64;
  v9 = RegHandle & -(__int64)(RegHandle != 0);
  if( !v9 )
    return -1073741816;
  v11 = *(_QWORD *)((RegHandle & -(__int64)(RegHandle != 0)) + 0x68);
  v28[0] = 0i64;
  BYTE4(v28[0]) = Level;
  v28[1] = Keyword;
  v12 = (v11 + 28) & -(__int64)(v11 != 0);
  v25 = (__int64)String;
  v13 = -1i64;
  do
    ++v13;
  while( String[v13] );
  v14 = *(_BYTE *)((RegHandle & -(__int64)(RegHandle != 0)) + 0x64);
  v26 = 2 * v13 + 2;
  v27 = 0;
  if( v14
    && EtwpLevelKeywordEnabled(
         (_TRACE_ENABLE_INFO *)(*(_QWORD *)((RegHandle & -(__int64)(RegHandle != 0)) + 0x20) + 96i64),
         Level,
         Keyword) )
  {
    v8 = EtwpEventWriteFull(
           v16,
           v15,
           0,
           v8,
           (__int64)v28,
           4,
           0,
           (__int64)ActivityId,
           0i64,
           1,
           (__int64)&v25,
           0i64,
           (__int64)v29,
           0i64,
           *(_WORD *)(v9 + 98),
           v12,
           (__int64)&v24);
  }
  if( *(_BYTE *)(v9 + 101)
    && EtwpLevelKeywordEnabled((_TRACE_ENABLE_INFO *)(*(_QWORD *)(v9 + 40) + 96i64), Level, Keyword) )
  {
    v8 = EtwpEventWriteFull(
           *(_QWORD *)(v9 + 32),
           v17,
           0,
           0,
           (__int64)v28,
           4,
           0,
           (__int64)ActivityId,
           0i64,
           1,
           (__int64)&v25,
           0i64,
           (__int64)v29,
           v18,
           *(_WORD *)(v9 + 98),
           v12,
           (__int64)&v24);
  }
  v19 = *(_QWORD *)(v9 + 32);
  if( *(_QWORD *)(v19 + 400) )
  {
    v20 = *(_BYTE *)(v9 + 102);
    *(_OWORD *)v29 = 0i64;
    v30 = 0i64;
    if( v20 && EtwpLevelKeywordEnabled((_TRACE_ENABLE_INFO *)(*(_QWORD *)(v19 + 400) + 96i64), Level, Keyword) )
      v8 = EtwpEventWriteFull(
             v22,
             v21,
             0,
             0,
             (__int64)v28,
             4,
             0,
             (__int64)ActivityId,
             0i64,
             1,
             (__int64)&v25,
             0i64,
             (__int64)v29,
             0i64,
             *(_WORD *)(v9 + 98),
             v12,
             (__int64)&v24);
    if( *(_BYTE *)(v9 + 103) )
    {
      if( EtwpLevelKeywordEnabled(
             (_TRACE_ENABLE_INFO *)(*(_QWORD *)(*(_QWORD *)(v9 + 40) + 400i64) + 96i64),
             Level,
             Keyword) )
      {
        return EtwpEventWriteFull(
                 *(_QWORD *)(*(_QWORD *)(v9 + 32) + 400i64),
                 *(_BYTE *)(v9 + 101),
                 0,
                 0,
                 (__int64)v28,
                 4,
                 0,
                 (__int64)ActivityId,
                 0i64,
                 1,
                 (__int64)&v25,
                 0i64,
                 (__int64)v29,
                 v23,
                 *(_WORD *)(v9 + 98),
                 v12,
                 (__int64)&v24);
      }
    }
  }
  return v8;
}

Referenced by: