EtwpTracingProvEnableCallback

VOID __fastcall EtwpTracingProvEnableCallback(
        const _GUID *SourceId,
        UINT64 ControlCode,
        UINT8 Level,
        UINT64 MatchAnyKeyword,
        UINT64 MatchAllKeyword,
        _EVENT_FILTER_DESCRIPTOR *FilterData,
        VOID *CallbackContext){
  _ETW_SILODRIVERSTATE *v7; 
  char v8; 
  unsigned int i; 
  volatile INT64 *j; 
  _WMI_LOGGER_CONTEXT *v11; 
  UINT64 v12; 
  unsigned int *v13; 
  _ETHREAD *CurrentThread; 
  EVENT_DESCRIPTOR *v15; 
  INT64 v16; 
  EVENT_DESCRIPTOR *v17; 
  unsigned int v18; 
  _DWORD *v19; 
  INT64 v20; 
  volatile INT64 *NextGuidEntry; 
  INT64 v22; 
  volatile INT64 *k; 
  __int64 v24; 
  _ETHREAD *v25; 
  EVENT_DESCRIPTOR *v26; 
  INT64 v27; 
  EVENT_DESCRIPTOR *v28; 
  unsigned int v29; 
  _DWORD *v30; 
  INT64 v31; 
  volatile INT64 *m; 
  INT64 v33; 
  volatile INT64 *v34; 
  volatile INT64 *v35; 
  if( (_DWORD)ControlCode == 2 )
  {
    v7 = (_ETW_SILODRIVERSTATE *)EtwpHostSiloState;
    v8 = 0;
    for( i = 0; i < *(_DWORD *)(EtwpHostSiloState + 16); ++i )
    {
      v11 = EtwpAcquireLoggerContextByLoggerId(v7, i, 0);
      v13 = (unsigned int *)v11;
      if( v11 )
      {
        EtwpEventWriteTemplateSession(v12, &ETW_EVENT_SESSION_INFO, v11);
        EtwpReleaseLoggerContext(v13, 0);
      }
      v7 = (_ETW_SILODRIVERSTATE *)EtwpHostSiloState;
    }
    for( j = 0i64; ; j = (volatile INT64 *)v22 )
    {
      NextGuidEntry = EtwpGetNextGuidEntry((INT64)v7, j, 2i64);
      v22 = (INT64)NextGuidEntry;
      if( !NextGuidEntry )
        break;
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --*((_WORD *)CurrentThread + 242);
      ExAcquirePushLockExclusiveEx((UINT64)(NextGuidEntry + 51), 0i64);
      *(_QWORD *)(v22 + 416) = KeGetCurrentThread();
      if( EtwEventEnabled(EtwpEventTracingProvRegHandle, (EVENT_DESCRIPTOR *)&ETW_EVENT_GROUP_ENTRY_INFO, v15) )
        EtwpEventWriteGuidEntry(v16, (EVENT_DESCRIPTOR *)&ETW_EVENT_GROUP_ENTRY_INFO, v22);
      v18 = 0;
      v19 = (_DWORD *)(v22 + 128);
      do
      {
        if( *v19 && EtwEventEnabled(EtwpEventTracingProvRegHandle, (EVENT_DESCRIPTOR *)&ETW_EVENT_ENABLE_INFO, v17) )
          EtwpEventWriteEnableInfo(v20, v22, v18);
        ++v18;
        v19 += 8;
      }
      while( v18 < 8 );
      *(_QWORD *)(v22 + 416) = 0i64;
      ExReleasePushLockEx(v22 + 408, 0i64);
      KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
      v7 = (_ETW_SILODRIVERSTATE *)EtwpHostSiloState;
    }
    for( k = 0i64; ; k = v35 )
    {
      v34 = EtwpGetNextGuidEntry(EtwpHostSiloState, k, 0i64);
      v35 = v34;
      if( !v34 )
        break;
      v24 = *((_QWORD *)v34 + 5) - *(_QWORD *)&EventTracingProvGuid.Data1;
      if( !v24 )
        v24 = *((_QWORD *)v35 + 6) - *(_QWORD *)EventTracingProvGuid.Data4;
      if( v24 )
      {
        v25 = (_ETHREAD *)KeGetCurrentThread();
        --*((_WORD *)v25 + 242);
        ExAcquirePushLockExclusiveEx((UINT64)(v35 + 51), 0i64);
        v8 = 1;
        *((_QWORD *)v35 + 52) = KeGetCurrentThread();
      }
      if( EtwEventEnabled(EtwpEventTracingProvRegHandle, (EVENT_DESCRIPTOR *)&ETW_EVENT_GUID_ENTRY_INFO, v26) )
        EtwpEventWriteGuidEntry(v27, (EVENT_DESCRIPTOR *)&ETW_EVENT_GUID_ENTRY_INFO, (INT64)v35);
      v29 = 0;
      v30 = v35 + 16;
      do
      {
        if( *v30 && EtwEventEnabled(EtwpEventTracingProvRegHandle, (EVENT_DESCRIPTOR *)&ETW_EVENT_ENABLE_INFO, v28) )
          EtwpEventWriteEnableInfo(v31, (INT64)v35, v29);
        ++v29;
        v30 += 8;
      }
      while( v29 < 8 );
      for( m = (volatile INT64 *)*((_QWORD *)v35 + 7); m != v35 + 7; m = (volatile INT64 *)*m )
      {
        if( EtwEventEnabled(EtwpEventTracingProvRegHandle, (EVENT_DESCRIPTOR *)&ETW_EVENT_REG_ENTRY_INFO, v28) )
          EtwpEventWriteRegEntry(v33, (INT64)m);
      }
      if( v8 )
      {
        *((_QWORD *)v35 + 52) = 0i64;
        ExReleasePushLockEx((UINT64)(v35 + 51), 0i64);
        KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
        v8 = 0;
      }
    }
  }
}

Referenced by: