EtwpProviderArrivalCallback

INT64 __fastcall EtwpProviderArrivalCallback(_WMI_LOGGER_CONTEXT *LoggerContext, CHAR Mode, _ETW_REG_ENTRY *RegEntry){
  void *Callback; 
  unsigned int v7; 
  int v8; 
  char *v9; 
  int FileNameForAddress; 
  UINT64 a4; 
  _UNICODE_STRING v13; 
  char v14[512]; 
  Callback = RegEntry->Callback;
  *(_DWORD *)(&v13.MaximumLength + 1) = 0;
  v7 = 0;
  if( !Callback )
    return 3221225793i64;
  if( (RegEntry->Flags & 0x20) != 0 || (*((_DWORD *)LoggerContext + 208) & 0x2000000) != 0 )
  {
    *(_DWORD *)&v13.Length = 0x2000000;
    v13.Buffer = (wchar_t *)v14;
    if( Mode )
      FileNameForAddress = MmGetFileNameForAddress(Callback, &v13);
    else
      FileNameForAddress = RtlPcToFilePath(Callback, &v13);
    v7 = FileNameForAddress;
    if( FileNameForAddress >= 0 )
      EtwpTrackBinaryForSession((INT64)LoggerContext, (const VOID **)&v13, (INT64)&RegEntry->GuidEntry->Guid);
    if( (char *)v13.Buffer != v14 )
      ExFreePoolWithTag(v13.Buffer, 0);
  }
  if( (RegEntry->Flags & 8) == 0 )
    return v7;
  if( (*((_DWORD *)LoggerContext + 3) & 0x80u) == 0 )
  {
    LODWORD(a4) = 512;
    *(_QWORD *)&v13.Length = v14;
    v8 = EtwpLocateDbgIdForRegEntry(Mode, (INT64)RegEntry, (UINT8 **)&v13, &a4);
    v9 = *(char **)&v13.Length;
    v7 = v8;
    if( v8 >= 0 )
    {
      EtwpTrackDebugIdForSession(LoggerContext, *(_QWORD *)&v13.Length, (unsigned int)a4);
      if( (*((_DWORD *)LoggerContext + 3) & 0x80000) != 0
        && (!(_BYTE)KdDebuggerNotPresent && !KdPitchDebugger || KdEventLoggingPresent) )
      {
        EtwpSendDbgId(LoggerContext);
      }
    }
    if( v9 != v14 )
      ExFreePoolWithTag(v9, 0);
    return v7;
  }
  return 3221225659i64;
}

Referenced by: