EtwpSendTraceEvent
VOID __fastcall EtwpSendTraceEvent(INT64 a1, INT64 a2){
__int64 v4;
__int64 v5;
__int128 v6;
INT64 v7;
int v8;
__int64 v9;
unsigned int v10;
__int128 v11[3];
__int128 v12;
__int64 v13;
unsigned int v14;
v14 = 0;
if( (*(_DWORD *)(a1 + 836) & 0x800) != 0 && ObGetCurrentIrql() < 2u )
EtwpSendDbgId((_WMI_LOGGER_CONTEXT *)a1);
if( (unsigned int)EtwpGetNextEventOffsetType(*(unsigned int **)a2, *(_DWORD *)(a2 + 16), &v14) )
{
if( (unsigned __int64)v14 + 72 <= (unsigned int)(KdTransportMaxPacketSize - 64) )
{
v6 = *(_OWORD *)v4;
v8 = 72;
v10 = v14;
v11[0] = v6;
v11[1] = *(_OWORD *)(v4 + 16);
v11[2] = *(_OWORD *)(v4 + 32);
v12 = *(_OWORD *)(v4 + 48);
*(_QWORD *)&v6 = *(_QWORD *)(v4 + 64);
LODWORD(v11[0]) = v14 + 72;
LODWORD(v12) = v14 + 72;
v7 = (INT64)v11;
v9 = v4 + v5;
v13 = v6;
KdSendTraceData((INT64)&v7, 2ui64);
}
}
}Referenced by:
EtwTraceEvent
EtwTraceRaw
EtwpEventWriteFull
EtwpLogKernelEvent
EtwpLogSystemEventUnsafe
EtwpTraceMessageVa
EtwpWriteUserEvent