EtwWriteErrorLogEntry

NTSTATUS __stdcall EtwWriteErrorLogEntry(
        UINT64 TraceHandle,
        _IO_ERROR_LOG_PACKET *ErrorLogPacket,
        UINT64 PacketSize,
        _LARGE_INTEGER *EventTimeStamp,
        PWCHAR ProviderName,
        PWCHAR DeviceName,
        UINT16 SidLength,
        PVOID SidData){
  unsigned __int16 v8; 
  unsigned int v9; 
  __int64 v11; 
  unsigned __int16 v12; 
  unsigned __int16 v13; 
  unsigned __int8 v14; 
  unsigned __int16 EventCategory; 
  __int64 v16; 
  __int64 v17; 
  int v18; 
  unsigned int v19; 
  unsigned int NumberOfStrings; 
  unsigned int v21; 
  __int64 v22; 
  unsigned int v23; 
  unsigned int v24; 
  unsigned __int16 v25; 
  __int64 v26; 
  unsigned int v27; 
  unsigned __int64 v28; 
  UCHAR *v29; 
  UCHAR *v30; 
  __int64 v31; 
  __int64 v32; 
  unsigned int v33; 
  __int64 v34; 
  NTSTATUS v35; 
  UINT64 UserDataCount; 
  unsigned __int16 v37; 
  __int16 v38; 
  unsigned int v39; 
  _ETW_GUID_ENTRY result; 
  _EVENT_DESCRIPTOR EventDescriptor; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  NTSTATUS *p_ErrorCode; 
  __int64 v44; 
  __int16 *v45; 
  __int64 v46; 
  PWCHAR v47; 
  int v48; 
  int v49; 
  UINT16 *p_SidLength; 
  __int64 v51; 
  PVOID v52; 
  int v53; 
  int v54; 
  v8 = *(_WORD *)IopErrorLogSession;
  v9 = (unsigned int)ErrorLogPacket->ErrorCode >> 30;
  v11 = (unsigned int)PacketSize;
  v12 = 0;
  v13 = 0;
  if( v9 == 1 )
    v14 = 4;
  else
    v14 = (v9 == 2) + 2;
  EventDescriptor.Level = v14;
  EventCategory = ErrorLogPacket->EventCategory;
  p_ErrorCode = &ErrorLogPacket->ErrorCode;
  v16 = -1i64;
  EventDescriptor.Task = EventCategory;
  v17 = -1i64;
  v44 = 4i64;
  *(_DWORD *)&EventDescriptor.Id = 0;
  EventDescriptor.Opcode = 0;
  EventDescriptor.Keyword = 0i64;
  UserData.Ptr = (unsigned __int64)EventTimeStamp;
  *(_QWORD *)&UserData.Size = 8i64;
  do
    ++v17;
  while( ProviderName[v17] );
  v47 = ProviderName;
  v18 = (unsigned __int16)(v17 + 1);
  v38 = v18;
  v48 = 2 * v18;
  v46 = 2i64;
  v51 = 2i64;
  v19 = 5;
  p_SidLength = &SidLength;
  v45 = &v38;
  v49 = 0;
  if( SidLength )
  {
    v19 = 6;
    v52 = SidData;
    v53 = SidLength;
    v54 = 0;
  }
  NumberOfStrings = ErrorLogPacket->NumberOfStrings;
  v21 = ErrorLogPacket->DumpDataSize + 40;
  if( v21 > (unsigned int)v11 )
    v21 = v11;
  v39 = v21;
  if( (_WORD)NumberOfStrings && ErrorLogPacket->StringOffset < v21 )
    ErrorLogPacket->StringOffset = v21;
  v22 = 2i64 * v19;
  v37 = 0;
  v23 = v19 + 1;
  v24 = NumberOfStrings;
  ErrorLogPacket->NumberOfStrings = NumberOfStrings + 1;
  v25 = 0;
  *(&UserData.Ptr + v22) = (unsigned __int64)&v37;
  *((_QWORD *)&UserData.Size + v22) = 2i64;
  v26 = 2i64 * v23;
  *(&UserData.Ptr + 2 * v23) = (unsigned __int64)DeviceName;
  do
    ++v16;
  while( DeviceName[v16] );
  *(&UserData.Reserved + 4 * v23) = 0;
  v27 = v23 + 1;
  *(&UserData.Size + 2 * v26) = 2 * (unsigned __int16)(v16 + 1);
  if( v24 )
  {
    v28 = (unsigned __int64)(&ErrorLogPacket->RetryCount + ErrorLogPacket->StringOffset) & 0xFFFFFFFFFFFFFFFEui64;
    v29 = &ErrorLogPacket->MajorFunctionCode + v11;
    do
    {
      v30 = (UCHAR *)(v28 + 2i64 * v13);
      if( v30 >= v29 )
        break;
      if( !*(_WORD *)v30 )
      {
        ++v25;
        v12 = v13 + 1;
        v37 = v25;
      }
      ++v13;
    }
    while( v25 < v24 );
    v31 = 2i64 * v27++;
    *(&UserData.Ptr + v31) = v28;
    *(&UserData.Size + 2 * v31) = 2 * v12;
    *(&UserData.Reserved + 2 * v31) = 0;
  }
  v32 = 2i64 * v27;
  v37 = v25 + 1;
  v33 = v27 + 1;
  *(&UserData.Ptr + v32) = (unsigned __int64)&v39;
  *((_QWORD *)&UserData.Size + v32) = 4i64;
  v34 = 2i64 * v33;
  *(&UserData.Size + 2 * v34) = v21;
  *(&UserData.Ptr + v34) = (unsigned __int64)ErrorLogPacket;
  *(&UserData.Reserved + 2 * v34) = 0;
  memset((INT64)&result, 0i64);
  result.SiloState = (_ETW_SILODRIVERSTATE *)EtwpHostSiloState;
  LODWORD(UserDataCount) = v33 + 1;
  result.Guid = (_GUID)LegacyEventLogGuid;
  result.EnableInfo[0].LoggerId = v8;
  result.EnableInfo[0].IsEnabled = 1;
  result.EnableInfo[0].Level = -1;
  *(__m128i *)&result.EnableInfo[0].MatchAnyKeyword = _mm_load_si128((const __m128i *)&_xmm);
  result.EnableInfo[0].EnableProperty = 64;
  v35 = EtwpEventWriteFull(
          &result,
          1u,
          0i64,
          0i64,
          &EventDescriptor,
          0,
          4u,
          0i64,
          0i64,
          UserDataCount,
          &UserData,
          0i64,
          0i64,
          0i64,
          0,
          0i64,
          0i64);
  if( v35 < 0 )
    --ErrorLogPacket->NumberOfStrings;
  return v35;
}

Referenced by: