EtwpTraceFileName

VOID __stdcall EtwpTraceFileName(VOID *FileKey, _UNICODE_STRING *FileName, UINT64 LoggerId, UINT16 HookId){
  __int64 v4; 
  int v7; 
  INT64 v8; 
  INT64 v9; 
  unsigned int v10; 
  INT64 *v11; 
  _ETW_SILODRIVERSTATE *v12; 
  LPCGUID RelatedActivityId; 
  __int16 v14; 
  __int64 v15[2]; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  __int64 v17; 
  unsigned int v18; 
  int v19; 
  __int16 *v20; 
  __int64 v21; 
  unsigned int v22; 
  INT16 v23; 

  v4 = HookId;
  v15[1] = 0i64;
  v14 = 0;
  if( FileKey )
  {
    v8 = *((_QWORD *)FileKey + 270);
  }
  else
  {
    LOBYTE(v7) = KeIsExecutingInArbitraryThreadContext();
    if( v7 )
    {
      v8 = 0i64;
    }
    else
    {
      LODWORD(v9) = PsGetThreadServerSilo((INT64)KeGetCurrentThread());
      v8 = v9;
    }
  }
  v10 = *(unsigned __int16 *)LoggerId;
  v15[0] = (__int64)FileName;
  if( v10 > 0x2000 )
    v10 = 0x2000;
  *(_QWORD *)&UserData.Size = 8i64;
  v18 = v10;
  UserData.Ptr = (unsigned __int64)v15;
  v17 = *(_QWORD *)(LoggerId + 8);
  v20 = &v14;
  v19 = 0;
  v21 = 2i64;
  if( EtwpHostSiloState != -4516 && (*(_DWORD *)(EtwpHostSiloState + 4516) & 0x200) != 0 )
  {
    if( v23 == 1056 )
    {
      EtwWriteEx(*(&ExBootDevicesRemovedEvent + 240), &KFileEvt_NameCreate, 0i64, 0, 0, 0, 3u, &UserData);
LABEL_12:
      LODWORD(RelatedActivityId) = 4200450;
      EtwTraceSiloKernelEvent(
        v8,
        (PGET_UPDATED_BUS_RESOURCE *)&UserData,
        3ui64,
        0x200ui64,
        v23,
        (INT64)RelatedActivityId);
      return;
    }
    if( v23 == 1059 )
      EtwWriteEx(*(&ExBootDevicesRemovedEvent + 240), &KFileEvt_NameDelete, 0i64, 0, 0, 0, 3u, &UserData);
  }
  if( v23 != 1060 )
    goto LABEL_12;
  if( v4 )
  {
    if( v4 != v8 )
      return;
    v11 = *(INT64 **)(v4 + 1272);
  }
  else
  {
    v11 = &PspHostSiloGlobals;
  }
  v12 = (_ETW_SILODRIVERSTATE *)v11[108];
  if( v12 )
    EtwpLogKernelEvent((__int64)&UserData, v12, v22, 3u, 0x424u, 0x401802u);
}

Referenced by: