EtwpUpdateFileHeader
INT64 __fastcall EtwpUpdateFileHeader(_WMI_LOGGER_CONTEXT *LoggerContext, UINT8 Append){
void *v4;
INT64 result;
int v6;
unsigned int Length;
_DWORD *PoolWithTag;
__int64 Buffer;
NTSTATUS v10;
void *v11;
char v12;
__int64 v13;
__int64 v14;
union _LARGE_INTEGER v15;
signed __int64 v16;
union _LARGE_INTEGER FileInformation;
struct _IO_STATUS_BLOCK IoStatusBlock;
IO_STATUS_BLOCK v19;
__int128 FsInformation;
__int64 v21;
__int128 v22;
__int64 v23;
v23 = 0i64;
v21 = 0i64;
v4 = (void *)*((_QWORD *)LoggerContext + 102);
v22 = 0i64;
FsInformation = 0i64;
IoStatusBlock = 0i64;
LODWORD(result) = ZwQueryVolumeInformationFile(v4, &IoStatusBlock, &FsInformation, 0x18u, FileFsSizeInformation);
if( (int)result >= 0 )
{
v6 = HIDWORD(v21) - 1;
if( Append )
{
Length = ~v6 & (HIDWORD(v21) + 383);
}
else
{
Length = *((_DWORD *)LoggerContext + 1);
if( (v6 & Length) != 0 )
return 3221225990i64;
}
PoolWithTag = ExAllocatePoolWithTag(PagedPool, (Length + 4095i64) & 0xFFFFFFFFFFFFF000ui64, 0x50777445ui64);
Buffer = (__int64)PoolWithTag;
if( !PoolWithTag )
return 3221225495i64;
if( !Append )
{
EtwpInitializeBufferHeader((__int16 *)LoggerContext, PoolWithTag);
EtwpResetBufferHeader(Buffer, 4);
EtwpAddLogHeader((__int64)LoggerContext, Buffer);
v10 = ZwWriteFile(
*((HANDLE *)LoggerContext + 102),
0i64,
0i64,
0i64,
&IoStatusBlock,
(PVOID)Buffer,
Length,
0i64,
0i64);
if( v10 >= 0 )
{
if( (*((_DWORD *)LoggerContext + 3) & 0x20) != 0 )
{
v15.QuadPart = *((unsigned int *)LoggerContext + 77)
* ((-(__int64)((*((_DWORD *)LoggerContext + 3) & 0x2000) != 0) & 0xFFFFFFFFFFF00400ui64)
+ 0x100000);
v19 = 0i64;
FileInformation = v15;
v10 = ZwSetInformationFile(
*((VOID **)LoggerContext + 102),
&v19,
&FileInformation,
8ui64,
FileEndOfFileInformation);
}
if( v10 >= 0 )
{
*((_DWORD *)LoggerContext + 66) = 1;
*((_DWORD *)LoggerContext + 55) = 1;
*((_QWORD *)LoggerContext + 29) = Length;
}
}
goto LABEL_11;
}
v11 = (void *)*((_QWORD *)LoggerContext + 102);
FileInformation.QuadPart = 0i64;
v10 = ZwReadFile(v11, 0i64, 0i64, 0i64, &IoStatusBlock, PoolWithTag, Length, &FileInformation, 0i64);
if( v10 >= 0 )
{
if( (*(_DWORD *)(Buffer + 136) & 0x4000402) != 0 )
{
v10 = -1073741811;
*((_DWORD *)LoggerContext + 15) = 1;
}
else
{
if( *(_BYTE *)(Buffer + 108) != 10 || *(_BYTE *)(Buffer + 109) )
{
v10 = -1073741811;
*((_DWORD *)LoggerContext + 15) = 2;
goto LABEL_11;
}
if( *(_DWORD *)(Buffer + 148) == (EtwpIsWow64Logger((INT64)LoggerContext) ? 4 : 8) )
{
v13 = *(unsigned int *)(Buffer + 104);
LODWORD(v14) = *(_DWORD *)(Buffer + 140);
if( (v6 & (unsigned int)v13) != 0 )
{
v10 = -1073741306;
}
else
{
if( (unsigned int)(v13 - 1024) > 0xFFFC00 )
{
v10 = -1073741811;
*((_DWORD *)LoggerContext + 15) = 4;
goto LABEL_11;
}
if( (*((_DWORD *)LoggerContext + 208) & 2) == 0 || *((_DWORD *)LoggerContext + 1) == (_DWORD)v13 )
{
if( !*(_QWORD *)(Buffer + 120) )
{
if( (v12 & 0x20) != 0 )
{
v10 = -1073741811;
*((_DWORD *)LoggerContext + 15) = 6;
goto LABEL_11;
}
v10 = ZwQueryInformationFile(
*((VOID **)LoggerContext + 102),
&IoStatusBlock,
&v22,
0x18ui64,
FileStandardInformation);
if( v10 < 0 )
{
*((_DWORD *)LoggerContext + 15) = 7;
goto LABEL_11;
}
v16 = *((unsigned int *)LoggerContext + 77)
* ((-(__int64)((*((_DWORD *)LoggerContext + 3) & 0x2000) != 0) & 0xFFFFFFFFFFF00400ui64) + 0x100000);
if( v16 && *((__int64 *)&v22 + 1) >= v16 )
{
v10 = -1073741432;
*((_DWORD *)LoggerContext + 15) = 8;
goto LABEL_11;
}
v14 = *((_QWORD *)&v22 + 1) / v13;
}
if( (_DWORD)v14 )
{
if( *(_DWORD *)(Buffer + 116) == (unsigned int)EtwpQueryUsedProcessorCount((INT64)LoggerContext) )
{
*(_QWORD *)(Buffer + 120) = 0i64;
v10 = ZwWriteFile(
*((HANDLE *)LoggerContext + 102),
0i64,
0i64,
0i64,
&IoStatusBlock,
(PVOID)Buffer,
Length,
&FileInformation,
0i64);
if( v10 >= 0 )
{
*((_DWORD *)LoggerContext + 66) = v14;
*((_DWORD *)LoggerContext + 55) = v14;
*((_DWORD *)LoggerContext + 1) = v13;
*((_QWORD *)LoggerContext + 29) = (unsigned int)(v13 * v14);
}
}
else
{
v10 = -1073741811;
*((_DWORD *)LoggerContext + 15) = 10;
}
}
else
{
v10 = -1073741811;
*((_DWORD *)LoggerContext + 15) = 9;
}
goto LABEL_11;
}
v10 = -1073741306;
*((_DWORD *)LoggerContext + 15) = 5;
}
}
else
{
v10 = -1073741811;
*((_DWORD *)LoggerContext + 15) = 3;
}
}
}
LABEL_11:
ExFreePoolWithTag((PVOID)Buffer, 0);
return(unsigned int)v10;
}
return result;
}Referenced by:
EtwpCreateLogFile