EtwpGetTraceGuidInfo
BOOL __fastcall EtwpGetTraceGuidInfo(INT64 a1, INT64 a2){
INT64 v2;
unsigned int *v3;
unsigned int v4;
int v5;
int v6;
unsigned int *v7;
INT64 v8;
unsigned __int16 *UserModeGlobalLogger;
unsigned int i;
__int64 v12;
_QWORD *v13;
_ETW_GUID_ENTRY *GuidEntryByGuid;
__int64 v16;
unsigned int v17;
_ETHREAD *CurrentThread;
_ETW_GUID_ENTRY *Flink;
unsigned int v20;
_DWORD *v21;
char v22;
__int64 v23;
_LIST_ENTRY *p_RegListHead;
_BYTE *v25;
int v26;
__int64 v27;
__int64 v28;
unsigned int j;
__int64 v30;
_OWORD *v31;
__int64 v32;
_OWORD *v33;
__int64 v34;
_LIST_ENTRY *v35;
int v36;
_DWORD *v37;
UINT64 v38;
int v39;
unsigned int k;
__int64 v41;
_OWORD *v42;
NTSTATUS v43;
__int64 v44;
__int64 v45;
__int64 v46;
int v47;
int v48;
unsigned int v49;
_BYTE *v50;
__int64 v51;
UINT64 ulAugend;
unsigned int *v53;
v53 = v3;
v4 = *v3;
v5 = 0;
v6 = 0;
LODWORD(ulAugend) = 8;
v7 = v3;
v8 = v2;
v47 = 0;
if( a1 == EtwpHostSiloState )
UserModeGlobalLogger = UKUSER_SHARED_DATA.UserModeGlobalLogger;
else
UserModeGlobalLogger = (unsigned __int16 *)(*(_QWORD *)(*(_QWORD *)(a1 + 8) + 1128i64) + 550i64);
for( i = 0; i < 0xA; ++i )
{
v12 = 2i64 * i;
v13 = (_QWORD *)*((_QWORD *)EtwpUmglProviders + 2 * i);
if( *v13 == *(_QWORD *)a2 && v13[1] == *(_QWORD *)(a2 + 8) )
{
memset(v8, 0i64);
v16 = *((unsigned __int8 *)EtwpUmglProviders + 8 * v12 + 8);
v17 = 24;
if( LOBYTE(UserModeGlobalLogger[v16]) )
{
v17 = 56;
if( v4 >= 0x38 )
{
*(_DWORD *)(v8 + 12) = 1;
*(_DWORD *)(v8 + 24) = 1;
*(_WORD *)(v8 + 30) = LOBYTE(UserModeGlobalLogger[v16]);
*(_QWORD *)(v8 + 40) = HIBYTE(UserModeGlobalLogger[v16]);
}
}
else
{
if( v4 < 0x18 )
goto LABEL_17;
*(_DWORD *)(v8 + 12) = 0;
}
if( v17 <= v4 )
{
*(_DWORD *)v8 = 1;
*(_DWORD *)(v8 + 20) = 1;
*(_DWORD *)(v8 + 16) = 0;
*(_DWORD *)(v8 + 8) = 0;
LABEL_18:
*v7 = v17;
return v6;
}
LABEL_17:
v6 = -1073741789;
goto LABEL_18;
}
}
GuidEntryByGuid = EtwpFindGuidEntryByGuid((_ETW_SILODRIVERSTATE *)a1, (const _GUID *)a2, EtwTraceGuidType);
if( !GuidEntryByGuid )
return -1073741163;
memset(v8, 0i64);
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
ExAcquirePushLockExclusiveEx((UINT64)&GuidEntryByGuid->Lock, 0i64);
Flink = (_ETW_GUID_ENTRY *)GuidEntryByGuid->RegListHead.Flink;
v20 = ulAugend;
GuidEntryByGuid->LockOwner = (_ETHREAD *)KeGetCurrentThread();
if( Flink != (_ETW_GUID_ENTRY *)&GuidEntryByGuid->RegListHead )
{
while( 1 )
{
v49 = v20;
v21 = (_DWORD *)(v8 + v20);
v22 = 0;
if( RtlULongAdd(v20, 0x10ui64, &ulAugend) < 0 )
break;
v20 = ulAugend;
v25 = (_BYTE *)(v23 + 98);
++v47;
v26 = 0;
v27 = v23;
v48 = 0;
v50 = (_BYTE *)(v23 + 98);
if( (*(_BYTE *)(v23 + 98) & 8) != 0 )
{
v22 = 1;
if( (*((_BYTE *)&GuidEntryByGuid->LastEnable + 11) & 1) != 0 )
{
if( RtlULongAdd((unsigned int)ulAugend, 0x20ui64, &ulAugend) < 0 )
break;
v20 = ulAugend;
v27 = v23;
v26 = 1;
v25 = v50;
if( (unsigned int)ulAugend <= v4 )
{
*(_DWORD *)v28 = 1;
*(_BYTE *)(v28 + 4) = GuidEntryByGuid->LastEnable.Level;
*(_QWORD *)(v28 + 16) = GuidEntryByGuid->LastEnable.EnableFlags.QuadPart;
*(_WORD *)(v28 + 6) = GuidEntryByGuid->LastEnable.LoggerId;
}
}
}
else if( *(_BYTE *)(v23 + 100) || *(_BYTE *)(v23 + 101) )
{
for( j = 0; j < 8; ++j )
{
v30 = 32 * (j + 4i64);
if( *(_DWORD *)((char *)&GuidEntryByGuid->GuidList.Flink + v30)
&& ((unsigned __int8)(1 << j) & *(_BYTE *)(v23 + 100)) != 0 )
{
v48 = v26 + 1;
if( RtlULongAdd(v20, 0x20ui64, &ulAugend) < 0 )
goto LABEL_57;
v20 = ulAugend;
v26 = v48;
if( (unsigned int)ulAugend <= v4 )
{
*v31 = *(_LIST_ENTRY *)((char *)&GuidEntryByGuid->GuidList + v30);
v31[1] = *(_LIST_ENTRY *)((char *)&GuidEntryByGuid->SiloGuidList + v30);
}
}
v32 = *(_QWORD *)(v23 + 40);
v51 = v32;
if( v32 && *(_DWORD *)(v32 + v30) && ((unsigned __int8)(1 << j) & *(_BYTE *)(v23 + 101)) != 0 )
{
v48 = v26 + 1;
if( RtlULongAdd(v20, 0x20ui64, &ulAugend) < 0 )
goto LABEL_57;
v20 = ulAugend;
if( (unsigned int)ulAugend <= v4 )
{
*v33 = *(_OWORD *)(v51 + v34);
v33[1] = *(_OWORD *)(v51 + v34 + 16);
}
}
v26 = v48;
}
v25 = v50;
p_RegListHead = &GuidEntryByGuid->RegListHead;
v22 = 0;
v27 = v23;
}
v35 = *(_LIST_ENTRY **)v23;
if( v20 <= v4 )
{
if( v22 == 1 )
v21[3] = 1;
if( (*v25 & 2) != 0 )
v36 = *(_DWORD *)(*(_QWORD *)(v27 + 80) + 1088i64);
else
v36 = 0;
v21[2] = v36;
v21[1] = v26;
if( v35 == p_RegListHead )
{
*v21 = 0;
LABEL_53:
v5 = v47;
goto LABEL_54;
}
*v21 = v20 - v49;
}
if( v35 == p_RegListHead )
goto LABEL_53;
}
LABEL_57:
GuidEntryByGuid->LockOwner = 0i64;
ExReleasePushLockEx((UINT64)&GuidEntryByGuid->Lock, 0i64);
KeLeaveCriticalRegion();
LABEL_58:
v20 = ulAugend;
v6 = -2147483643;
goto LABEL_59;
}
LABEL_54:
GuidEntryByGuid->LockOwner = 0i64;
ExReleasePushLockEx((UINT64)&GuidEntryByGuid->Lock, 0i64);
KeLeaveCriticalRegion();
if( !v5 )
{
v5 = 2;
v47 = 2;
if( RtlULongAdd(v20, 0x10ui64, &ulAugend) >= 0 )
{
v38 = (unsigned int)ulAugend;
v39 = 0;
for( k = 0; k < 8; ++k )
{
if( GuidEntryByGuid->EnableInfo[k].IsEnabled )
{
++v39;
if( RtlULongAdd(v38, 0x20ui64, &ulAugend) < 0 )
goto LABEL_58;
v38 = (unsigned int)ulAugend;
if( (unsigned int)ulAugend <= v4 )
{
*v42 = *(_LIST_ENTRY *)((char *)&GuidEntryByGuid->GuidList + v41);
v42[1] = *(_LIST_ENTRY *)((char *)&GuidEntryByGuid->SiloGuidList + v41);
}
}
}
if( (unsigned int)v38 <= v4 )
{
v37[2] = 0;
v37[1] = v39;
*v37 = v38 - v20;
v37[3] = 2;
}
if( RtlULongAdd(v38, 0x10ui64, &ulAugend) < 0 )
goto LABEL_58;
v43 = RtlULongAdd((unsigned int)ulAugend, 0x20ui64, &ulAugend);
v20 = ulAugend;
if( v43 < 0 )
{
v6 = -2147483643;
goto LABEL_59;
}
if( (unsigned int)ulAugend > v4 )
{
LABEL_59:
v5 = v47;
}
else
{
*(_QWORD *)(v44 + 4) = v46;
*(_DWORD *)v44 = v46;
*(_DWORD *)(v44 + 12) = 3;
*(_DWORD *)v45 = *((_BYTE *)&GuidEntryByGuid->LastEnable + 11) & 1;
v5 = 2;
if( (*((_BYTE *)&GuidEntryByGuid->LastEnable + 11) & 1) != 0 )
{
*(_DWORD *)(v44 + 4) = 1;
*(_BYTE *)(v45 + 4) = GuidEntryByGuid->LastEnable.Level;
*(_QWORD *)(v45 + 16) = GuidEntryByGuid->LastEnable.EnableFlags.QuadPart;
*(_WORD *)(v45 + 6) = GuidEntryByGuid->LastEnable.LoggerId;
}
}
}
else
{
v20 = ulAugend;
v6 = -2147483643;
}
}
EtwpUnreferenceGuidEntry(GuidEntryByGuid);
if( v6 >= 0 )
{
if( v20 > v4 )
v6 = -1073741789;
else
*(_DWORD *)v8 = v5;
}
*v53 = v20;
return v6;
}Referenced by:
NtTraceControl