EtwTraceRaw

INT64 __stdcall EtwTraceRaw(UINT64 TraceHandle, VOID *Data, UINT64 DataSize, INT8 RequestorMode){
  UINT64 v5; 
  int ReserveTraceBufferStatus; 
  unsigned int v7; 
  INT64 v8; 
  INT64 v9; 
  INT64 v10; 
  UINT8 *v11; 
  INT64 v13[2]; 
  INT64 a1[2]; 
  __int64 v15; 
  CHAR a3; 
  void *Src; 
  INT8 v18; 
  v18 = RequestorMode;
  Src = Data;
  v5 = (unsigned int)DataSize;
  *(_OWORD *)a1 = 0i64;
  v15 = 0i64;
  a3 = 0;
  ReserveTraceBufferStatus = 0;
  v13[0] = 0i64;
  v7 = (unsigned __int16)TraceHandle;
  if( RequestorMode )
    v8 = PsGetCurrentServerSiloGlobals()[108];
  else
    v8 = EtwpHostSiloState;
  if( v7 < *(_DWORD *)(v8 + 16) )
  {
    v9 = EtwpOpenLogger(v7, v8, RequestorMode, &a3);
    v10 = v9;
    v13[1] = v9;
    if( v9 )
    {
      if( (*(_DWORD *)(v9 + 12) & 0x80u) != 0 )
      {
        ReserveTraceBufferStatus = -1073741790;
LABEL_31:
        EtwpCloseLogger(v7, v8, a3);
        return(unsigned int)ReserveTraceBufferStatus;
      }
      if( RequestorMode )
      {
        ReserveTraceBufferStatus = EtwpCheckLoggerControlAccess(0x200ui64, (_WMI_LOGGER_CONTEXT *)v9);
        if( ReserveTraceBufferStatus < 0 )
          goto LABEL_31;
        if( (_DWORD)v5 )
        {
          if( ((unsigned __int8)Src & 3) != 0 )
            ExRaiseDatatypeMisalignment();
          if( (unsigned __int64)Src + v5 > 0x7FFFFFFF0000i64 || (char *)Src + v5 < Src )
            MEMORY[0x7FFFFFFF0000] = 0;
        }
      }
      else if( (*(_DWORD *)(v9 + 12) & 0x1000000) != 0 )
      {
        ReserveTraceBufferStatus = -1073741637;
        goto LABEL_31;
      }
      v11 = (UINT8 *)EtwpReserveTraceBuffer((UINT64 *)v10, (unsigned int)v5, (INT64)a1, v13, 0);
      if( v11 )
      {
        memmove(v11, (UINT8 *)Src, v5);
        if( (*(_DWORD *)(v10 + 12) & 0x80000) != 0
          && (!(_BYTE)KdDebuggerNotPresent && !KdPitchDebugger || KdEventLoggingPresent) )
        {
          EtwpSendTraceEvent(v10, (INT64)a1);
        }
        if( *(_QWORD *)(v10 + 1272) )
          EtwpInvokeEventCallback(v10, (INT64)a1, 0i64);
        EtwpReleaseTraceBuffer(a1);
      }
      else
      {
        ReserveTraceBufferStatus = EtwpGetReserveTraceBufferStatus(v10, v5);
      }
      goto LABEL_31;
    }
  }
  return(unsigned int)-1073741816;
}

Referenced by: