IoWMIWriteEvent

NTSTATUS __stdcall IoWMIWriteEvent(PVOID WnodeEventItem){
  NTSTATUS v1; 
  int v3; 
  UINT64 v4; 
  _LIST_ENTRY *PoolWithTag; 
  unsigned int v6; 
  unsigned __int8 v7; 
  unsigned __int64 v8; 
  VOID **RegEntryByProviderId; 
  _LIST_ENTRY *v10; 
  NTSTATUS result; 
  int v12; 
  int v13; 
  UINT16 v14; 
  v1 = 0;
  if( !WmipServiceDeviceObject )
    return -1073741823;
  v3 = *((_DWORD *)WnodeEventItem + 11);
  if( (v3 & 0x60000) != 0 )
  {
    v12 = *(_DWORD *)WnodeEventItem;
    v13 = v3 & 0x20000;
    v14 = *((_WORD *)WnodeEventItem + 4);
    if( (unsigned int)v12 < 0x30 )
      return -1073741789;
    if( v13 )
    {
      if( (unsigned int)v12 <= 0xFFFF )
        goto LABEL_15;
    }
    else if( v12 >= 0 )
    {
LABEL_15:
      result = EtwTraceEvent(v14, (UINT16 *)WnodeEventItem, 0x30ui64, 3222536192i64, 0);
      if( v13 )
        return result;
      goto LABEL_3;
    }
    return -2147483643;
  }
LABEL_3:
  PoolWithTag = (_LIST_ENTRY *)ExAllocatePoolWithTag(NonPagedPoolNx, 0x20ui64, 0x77696D57ui64);
  if( !PoolWithTag )
    return -1073741670;
  v6 = *((_DWORD *)WnodeEventItem + 1);
  KeAcquireSpinLockRaiseToDpc(&WmipRegistrationSpinLock, v4);
  v8 = v7;
  RegEntryByProviderId = WmipDoFindRegEntryByProviderId(v6);
  v10 = (_LIST_ENTRY *)RegEntryByProviderId;
  if( RegEntryByProviderId )
    _InterlockedIncrement((volatile signed __int32 *)RegEntryByProviderId + 12);
  KxReleaseSpinLock(&WmipRegistrationSpinLock);
  __writecr8(v8);
  *((_DWORD *)WnodeEventItem + 10) = *((_DWORD *)WnodeEventItem + 2);
  PoolWithTag[1].Flink = v10;
  PoolWithTag[1].Blink = (_LIST_ENTRY *)WnodeEventItem;
  ExInterlockedInsertTailList(&WmipNPEvent, PoolWithTag, &WmipNPNotificationSpinlock);
  if( _InterlockedIncrement(&WmipEventWorkItems) == 1 )
    ExQueueWorkItem(&WmipEventWorkQueueItem, DelayedWorkQueue);
  return v1;
}

Referenced by: