EtwWmitraceWorker

VOID __stdcall EtwWmitraceWorker(){
  _ETW_SILODRIVERSTATE *EtwSiloState; 
  int SiloBySessionId; 
  unsigned int v2; 
  int v3; 
  int v4; 
  int updated; 
  int v6; 
  INT8 v7; 
  INT8 v8; 
  int started; 
  UINT64 EnableProperty; 
  _EJOB *DestinationString; 
  struct _STRING DestinationString_8; 
  INT64 result; 
  unsigned __int16 v14; 
  int v15; 
  int v16; 
  int v17; 
  int v18; 
  int v19; 
  int v20; 
  UNICODE_STRING v21; 
  struct _UNICODE_STRING UnicodeString; 
  memset((INT64)&result, 0i64);
  DestinationString = 0i64;
  DestinationString_8 = 0i64;
  if( (_DWORD)SessionId )
  {
    SiloBySessionId = PsGetSiloBySessionId((unsigned int)SessionId, &DestinationString);
    if( SiloBySessionId < 0 || !DestinationString )
      goto LABEL_33;
    EtwSiloState = DestinationString->ServerSiloGlobals->EtwSiloState;
  }
  else
  {
    EtwSiloState = (_ETW_SILODRIVERSTATE *)EtwpHostSiloState;
  }
  if( EtwWmitraceWork == 1 )
  {
    EtwpPrepareWmitraceLoggerInfo((INT64)&result);
    RtlInitAnsiString(&DestinationString_8, (PCSZ)&OrKeywordMask, v7);
    RtlAnsiStringToUnicodeString(&UnicodeString, &DestinationString_8, 1u);
    v16 = dword_140C19D10;
    v17 = dword_140C19D14;
    v15 = dword_140C19D18;
    v19 = dword_140C19D1C;
    v20 = dword_140C19D20;
    v18 = dword_140C19D0C;
    if( byte_140C19C89 )
    {
      RtlInitAnsiString(&DestinationString_8, &byte_140C19C89, v8);
      RtlAnsiStringToUnicodeString(&v21, &DestinationString_8, 1u);
    }
    started = EtwpStartTrace((__int64)EtwSiloState, (__int64)&result);
    SiloBySessionId = started;
    if( started >= 0 )
      LODWORD(EtwpWmitraceParams) = v14;
    else
      DbgPrintEx(0x17u, 3u, "wmitrace: EtwpStartTrace failed: 0x%x\n", (unsigned int)started);
    RtlFreeAnsiString(&UnicodeString);
    if( byte_140C19C89 )
      RtlFreeAnsiString(&v21);
  }
  else
  {
    v2 = 2;
    if( EtwWmitraceWork == 2 )
    {
      EtwpPrepareWmitraceLoggerInfo((INT64)&result);
      v3 = EtwpQueryTrace((__int64)EtwSiloState, &result);
      SiloBySessionId = v3;
      if( v3 < 0 )
        goto LABEL_22;
      v6 = EtwpStopTrace((__int64)EtwSiloState, &result, 0);
      SiloBySessionId = v6;
      if( v6 < 0 )
        DbgPrintEx(0x17u, 3u, "wmitrace: EtwpStopTrace failed: 0x%x\n", (unsigned int)v6);
    }
    else
    {
      if( EtwWmitraceWork != 3 )
      {
        if( (unsigned __int8)(EtwWmitraceWork - 4) > 2u )
        {
          SiloBySessionId = -1073741637;
          DbgPrintEx(0x17u, 3u, "Unknown command passed to EtwWmitraceWorker.\n");
          goto LABEL_33;
        }
        EtwpPrepareWmitraceLoggerInfo((INT64)&result);
        v3 = EtwpQueryTrace((__int64)EtwSiloState, &result);
        SiloBySessionId = v3;
        if( v3 >= 0 )
        {
          if( EtwWmitraceWork == 4 )
          {
            v2 = 1;
          }
          else if( EtwWmitraceWork == 5 )
          {
            v2 = 0;
          }
          LODWORD(EnableProperty) = ::EnableProperty;
          v4 = EtwEnableTrace(
                 &stru_140C19C5C,
                 0i64,
                 (unsigned int)EtwpWmitraceParams,
                 v2,
                 Level,
                 OrKeywordMask,
                 AndKeywordMask,
                 EnableProperty);
          SiloBySessionId = v4;
          if( v4 < 0 )
            DbgPrintEx(0x17u, 3u, "wmitrace: EtwpEnableTraceEx failed: 0x%x\n", (unsigned int)v4);
          goto LABEL_33;
        }
LABEL_22:
        DbgPrintEx(0x17u, 3u, "wmitrace: EtwpQueryTrace failed: 0x%x\n", (unsigned int)v3);
        goto LABEL_33;
      }
      EtwpPrepareWmitraceLoggerInfo((INT64)&result);
      v3 = EtwpQueryTrace((__int64)EtwSiloState, &result);
      SiloBySessionId = v3;
      if( v3 < 0 )
        goto LABEL_22;
      v19 |= 0x80000u;
      updated = EtwpUpdateTrace((__int64)EtwSiloState, (__int64)&result);
      SiloBySessionId = updated;
      if( updated < 0 )
        DbgPrintEx(0x17u, 3u, "wmitrace: failed to enable KD_FILTER 0x%x\n", (unsigned int)updated);
    }
  }
LABEL_33:
  dword_140C19D28 = SiloBySessionId;
  EtwWmitraceWork = 0;
}

Referenced by: