EtwpTraceMessageVa
NTSTATUS __stdcall EtwpTraceMessageVa(
UINT64 TraceHandle,
UINT64 MessageFlags,
GUID *MessageGuid,
UINT16 MessageNumber,
PSTR MessageArgList,
INT8 RequestorMode){
char v6;
unsigned int v7;
PSTR v8;
unsigned __int64 v9;
CHAR *v10;
INT64 v11;
INT64 v12;
UINT64 *v13;
int v14;
char v15;
char v16;
PSTR v17;
PSTR v18;
__int64 v19;
unsigned __int64 v20;
NTSTATUS result;
int v22;
int v23;
int v24;
int v25;
int v26;
unsigned int v27;
INT64 v28;
signed __int32 v29;
__int64 v30;
volatile signed __int32 *v31;
unsigned __int64 v32;
__int16 v33;
GUID *v34;
UINT8 *v35;
_ETHREAD *CurrentThread;
UINT8 *v37;
PSTR v38;
UINT8 *v39;
UINT64 v40;
int v41;
INT64 v42;
char v43;
char v44;
NTSTATUS v45;
CHAR v46[16];
NTSTATUS v47;
UINT8 *v48;
UINT16 v49;
unsigned int v50;
INT64 v51;
PSTR v52;
PSTR v53;
CHAR *v54;
UINT64 v55;
int v56;
int v57;
int v58;
int v59;
INT64 v60;
CHAR *v61;
INT64 v62;
INT64 v63;
int v64;
int v65;
GUID *v66;
unsigned __int64 v67;
INT64 a1[2];
__int64 v69;
_ETHREAD *v70;
INT64 v71[2];
v49 = MessageNumber;
v66 = MessageGuid;
v6 = MessageFlags;
LOWORD(v7) = TraceHandle;
v55 = TraceHandle;
v8 = MessageArgList;
v46[1] = RequestorMode;
v46[8] = RequestorMode;
*(_OWORD *)a1 = 0i64;
v69 = 0i64;
v46[0] = 0;
*(_OWORD *)v71 = 0i64;
v9 = 0i64;
v47 = 0;
v45 = 0;
v60 = 0i64;
v10 = 0i64;
v54 = 0i64;
v61 = 0i64;
if( RequestorMode )
v11 = PsGetCurrentServerSiloGlobals()[108];
else
v11 = EtwpHostSiloState;
v63 = v11;
v51 = v11;
v7 = (unsigned __int16)v7;
v50 = v7;
if( (unsigned int)(unsigned __int16)v7 >= *(_DWORD *)(v11 + 16) )
return -1073741816;
v12 = EtwpOpenLogger((unsigned __int16)v7, v11, RequestorMode, v46);
v13 = (UINT64 *)v12;
v62 = v12;
if( !v12 )
return -1073741816;
v14 = *(_DWORD *)(v12 + 12);
if( (v14 & 0x80u) != 0 )
{
result = -1073741790;
goto LABEL_100;
}
if( !RequestorMode && (v14 & 0x1000000) != 0 )
{
result = -1073741637;
LABEL_100:
v45 = result;
goto LABEL_86;
}
v52 = 0i64;
v15 = v6 & 0x40;
v43 = v6 & 0x40;
v16 = v6 & 0x80;
v44 = v6 & 0x80;
if( (v6 & 0x40) != 0 )
{
v10 = &MessageArgList[HIDWORD(v55)];
v54 = v10;
v61 = v10;
}
v55 = 0i64;
v17 = MessageArgList;
v52 = MessageArgList;
while( 1 )
{
if( !v15 )
{
v18 = v17 + 8;
LABEL_13:
v19 = *((_QWORD *)v18 - 1);
goto LABEL_14;
}
if( !v16 )
{
v18 = v17 + 8;
if( v18 > v10 )
{
result = -1073741306;
v45 = -1073741306;
v11 = v51;
goto LABEL_86;
}
goto LABEL_13;
}
v18 = v17 + 4;
if( v18 > v10 )
{
result = -1073741306;
v45 = -1073741306;
v11 = v51;
goto LABEL_86;
}
v19 = *((unsigned int *)v18 - 1);
LABEL_14:
v52 = v18;
if( !v19 )
break;
if( v15 && v16 )
{
v17 = v18 + 4;
v20 = *((unsigned int *)v17 - 1);
}
else
{
v17 = v18 + 8;
v20 = *((_QWORD *)v17 - 1);
}
v52 = v17;
if( v20 )
{
v9 += v20;
v55 = v9;
if( v9 < v20 )
{
result = -1073741675;
v45 = -1073741675;
v11 = v51;
goto LABEL_86;
}
}
}
if( !v13[35] )
v6 &= ~1u;
v56 = v6 & 1;
v22 = 4;
if( (v6 & 1) != 0 )
v23 = 4;
else
v23 = 0;
v58 = v6 & 2;
if( (v6 & 2) != 0 )
v24 = 16;
else
v24 = 0;
v57 = v6 & 4;
if( (v6 & 4) == 0 )
v22 = 0;
v25 = 8;
if( (v6 & 0x18) != 0 )
v26 = 8;
else
v26 = 0;
v59 = v6 & 0x20;
if( (v6 & 0x20) == 0 )
v25 = 0;
v27 = v9 + v23 + v24 + v22 + v26 + v25 + 8;
if( v9 > v27 )
{
result = -1073741306;
LABEL_99:
v11 = v51;
goto LABEL_100;
}
v28 = EtwpReserveTraceBuffer(v13, v27, (INT64)a1, &v60, 0);
v29 = 0;
v30 = v62;
v31 = *(volatile signed __int32 **)(v62 + 280);
if( v31 )
{
v29 = _InterlockedIncrement(v31);
v9 = v55;
v47 = 0;
v15 = v43;
v32 = (unsigned __int64)v61;
v54 = v61;
v16 = v44;
}
else
{
v32 = (unsigned __int64)v54;
}
if( !v28 )
{
result = EtwpGetReserveTraceBufferStatus(v30, v27);
v7 = v50;
goto LABEL_99;
}
*(_DWORD *)v28 = -1879048192;
*(_WORD *)v28 = v27;
*(_WORD *)(v28 + 4) = v49;
if( v16 )
v33 = 64;
else
v33 = 128;
*(_WORD *)(v28 + 6) = v33 | v6 & 0x3F;
v34 = v66;
*(GUID *)v71 = *v66;
v35 = (UINT8 *)(v28 + 8);
v48 = v35;
if( v56 )
{
*(_DWORD *)v35 = v29;
v35 += 4;
v48 = v35;
}
if( v57 )
{
*(_DWORD *)v35 = v34->Data1;
v35 += 4;
LABEL_53:
v48 = v35;
}
else if( v58 )
{
*(GUID *)v35 = *v34;
v35 += 16;
goto LABEL_53;
}
if( (v6 & 8) != 0 )
{
*(_QWORD *)v35 = v60;
v35 += 8;
v48 = v35;
}
if( v59 )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v70 = CurrentThread;
v64 = *((_DWORD *)CurrentThread + 288);
v37 = v48;
*(_DWORD *)v48 = v64;
v37 += 4;
v48 = v37;
v65 = *((_DWORD *)CurrentThread + 286);
*(_DWORD *)v37 = v65;
v35 = v37 + 4;
v48 = v35;
v9 = v55;
v47 = 0;
v15 = v43;
v32 = (unsigned __int64)v61;
v54 = v61;
v16 = v44;
}
v67 = v9;
v53 = MessageArgList;
while( 1 )
{
do
{
if( v15 && v16 )
{
v38 = v8 + 4;
v39 = (UINT8 *)*((unsigned int *)v38 - 1);
}
else
{
v38 = v8 + 8;
v39 = (UINT8 *)*((_QWORD *)v38 - 1);
}
v53 = v38;
if( !v39 )
{
v41 = v47;
goto LABEL_81;
}
if( !v15 )
goto LABEL_66;
if( (unsigned __int64)v38 >= v32 )
{
v41 = -1073741306;
v47 = -1073741306;
v45 = -1073741306;
goto LABEL_81;
}
if( v16 )
{
v8 = v38 + 4;
v40 = *((unsigned int *)v8 - 1);
}
else
{
LABEL_66:
v8 = v38 + 8;
v40 = *((_QWORD *)v8 - 1);
}
v53 = v8;
}
while( !v40 );
if( v40 > v9 )
break;
if( v15 && ((unsigned __int64)&v39[v40] > 0x7FFFFFFF0000i64 || &v39[v40] < v39) )
MEMORY[0x7FFFFFFF0000] = 0;
memmove(v35, v39, v40);
v9 -= v40;
v67 = v9;
v35 += v40;
v48 = v35;
v32 = (unsigned __int64)v54;
}
v41 = -1073741306;
v47 = -1073741306;
v45 = -1073741306;
LABEL_81:
v11 = v51;
if( v41 >= 0 )
{
v42 = v62;
if( (*(_DWORD *)(v62 + 12) & 0x80000) != 0
&& (!(_BYTE)KdDebuggerNotPresent && !KdPitchDebugger || KdEventLoggingPresent) )
{
EtwpSendTraceEvent(v62, (INT64)a1);
v42 = v62;
}
if( *(_QWORD *)(v42 + 1272) )
EtwpInvokeEventCallback(v42, (INT64)a1, (INT64)v71);
}
EtwpReleaseTraceBuffer(a1);
result = v47;
v7 = v50;
LABEL_86:
if( v46[0] )
{
ExReleaseRundownProtectionCacheAwareEx(*(PEX_RUNDOWN_REF_CACHE_AWARE *)(*(_QWORD *)(v11 + 448) + 8i64 * v7), 1u);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
return v45;
}
return result;
}Referenced by:
NtTraceEvent
WmiTraceMessage
WmiTraceMessageVa