KitLogFeatureUsage

NTSTATUS __fastcall KitLogFeatureUsage(INT64 a1, INT64 a2, EVENT_DESCRIPTOR *a3){
  int v4; 
  int v6; 
  int v7; 
  UINT64 UserDataCount; 
  __int16 FilePath; 
  int FilePath_4; 
  UNICODE_STRING FilePath_8; 
  EVENT_DATA_DESCRIPTOR UserData; 
  int *p_FilePath_4; 
  int v15; 
  int v16; 
  __int16 *p_FilePath; 
  int v18; 
  int v19; 
  wchar_t *Buffer; 
  int Length; 
  int v22; 
  INT64 result[64]; 
  v4 = (int)a3;
  FilePath_4 = (int)a3;
  FilePath_8 = 0i64;
  if( KitEtwHandle && EtwEventEnabled(KitEtwHandle, (EVENT_DESCRIPTOR *)&KitFeatureIdUsedEvent, a3) )
  {
    if( v4 )
    {
      v6 = v4 - 1;
      if( v6 )
      {
        if( v6 != 1 || (a2 = *(_QWORD *)(a2 + 8)) == 0 )
        {
LABEL_13:
          FilePath_4 = 3;
          FilePath_8 = *(UNICODE_STRING *)&NoCallerIdString;
LABEL_14:
          UserData.Reserved = 0;
          v16 = 0;
          v19 = 0;
          v22 = 0;
          p_FilePath_4 = &FilePath_4;
          FilePath = FilePath_8.Length >> 1;
          p_FilePath = &FilePath;
          Buffer = FilePath_8.Buffer;
          Length = FilePath_8.Length;
          LODWORD(UserDataCount) = 4;
          v15 = 4;
          UserData.Ptr = a1;
          UserData.Size = 16;
          v18 = 2;
          return EtwWriteEx(
                   KitEtwHandle,
                   (EVENT_DESCRIPTOR *)&KitFeatureIdUsedEvent,
                   0i64,
                   0i64,
                   0i64,
                   0i64,
                   UserDataCount,
                   &UserData);
        }
      }
      a2 = *(_QWORD *)(a2 + 24);
    }
    if( a2 )
    {
      memset((INT64)result, 0i64);
      FilePath_8.MaximumLength = 510;
      FilePath_8.Buffer = (wchar_t *)result;
      if( KeGetCurrentIrql() > 1u )
        RtlPcToFileName((_CM_KCB_UOW *)a2);
      else
        v7 = RtlPcToFilePath((PVOID)a2, &FilePath_8);
      if( v7 >= 0 )
        goto LABEL_14;
    }
    goto LABEL_13;
  }
  return 0;
}

Referenced by: