EtwWriteEx

NTSTATUS __stdcall EtwWriteEx(
        UINT64 RegHandle,
        EVENT_DESCRIPTOR *EventDescriptor,
        UINT64 Filter,
        UINT64 Flags,
        GUID *ActivityId,
        GUID *RelatedActivityId,
        UINT64 UserDataCount,
        EVENT_DATA_DESCRIPTOR *UserData){
  unsigned int v9; 
  NTSTATUS v12; 
  __int64 v13; 
  UINT8 v14; 
  VOID *Traits; 
  _ETW_GUID_ENTRY *v16; 
  unsigned __int64 Keyword; 
  unsigned __int8 Level; 
  __int64 v19; 
  UINT8 v21; 
  _ETW_GUID_ENTRY *GroupEntry; 
  char v23; 
  UINT8 v24; 
  _ETW_GUID_ENTRY *v25; 
  _EVENT_DATA_DESCRIPTOR *v26; 
  UINT8 v27; 
  _ETW_GUID_ENTRY *v28; 
  UINT64 v29; 
  UINT64 EventKey; 
  UINT64 LoggerMask[2]; 
  __int128 v32; 
  v9 = Flags;
  EventKey = 0i64;
  v12 = 0;
  *(_OWORD *)LoggerMask = 0i64;
  v32 = 0i64;
  if( !RegHandle )
    return -1073741816;
  v13 = *(_QWORD *)(RegHandle + 104);
  v14 = *(_BYTE *)(RegHandle + 100);
  Traits = (VOID *)(v13 + 28);
  if( !v13 )
    Traits = 0i64;
  if( v14 )
  {
    v16 = *(_ETW_GUID_ENTRY **)(RegHandle + 32);
    Keyword = EventDescriptor->Keyword;
    if( v16->ProviderEnableInfo.IsEnabled )
    {
      Level = v16->ProviderEnableInfo.Level;
      if( (EventDescriptor->Level <= Level || !Level)
        && ((v16->ProviderEnableInfo.EnableProperty & 0x40) != 0 && !Keyword
         || (Keyword & v16->ProviderEnableInfo.MatchAnyKeyword) != 0
         && (Keyword & v16->ProviderEnableInfo.MatchAllKeyword) == v16->ProviderEnableInfo.MatchAllKeyword) )
      {
        LODWORD(v29) = UserDataCount;
        v12 = EtwpEventWriteFull(
                v16,
                v14,
                Filter,
                v9,
                EventDescriptor,
                0,
                0,
                ActivityId,
                RelatedActivityId,
                v29,
                UserData,
                0i64,
                LoggerMask,
                0i64,
                *(_WORD *)(RegHandle + 98),
                Traits,
                &EventKey);
      }
    }
  }
  if( *(_BYTE *)(RegHandle + 101)
    && EtwpLevelKeywordEnabled(*(_QWORD *)(RegHandle + 40) + 96i64, EventDescriptor->Level, EventDescriptor->Keyword) )
  {
    LODWORD(v29) = UserDataCount;
    v12 = EtwpEventWriteFull(
            *(_ETW_GUID_ENTRY **)(RegHandle + 32),
            v21,
            Filter,
            v9,
            EventDescriptor,
            0,
            0,
            ActivityId,
            RelatedActivityId,
            v29,
            UserData,
            0i64,
            LoggerMask,
            GroupEntry,
            *(_WORD *)(RegHandle + 98),
            Traits,
            &EventKey);
  }
  v19 = *(_QWORD *)(RegHandle + 32);
  if( *(_QWORD *)(v19 + 400) )
  {
    v23 = *(_BYTE *)(RegHandle + 102);
    *(_OWORD *)LoggerMask = 0i64;
    v32 = 0i64;
    if( v23 )
    {
      v26 = UserData;
      if( EtwpLevelKeywordEnabled(*(_QWORD *)(v19 + 400) + 96i64, EventDescriptor->Level, EventDescriptor->Keyword) )
      {
        LODWORD(v29) = UserDataCount;
        v12 = EtwpEventWriteFull(
                v25,
                v24,
                0i64,
                v9,
                EventDescriptor,
                0,
                0,
                ActivityId,
                RelatedActivityId,
                v29,
                UserData,
                0i64,
                LoggerMask,
                0i64,
                *(_WORD *)(RegHandle + 98),
                Traits,
                &EventKey);
      }
    }
    else
    {
      v26 = UserData;
    }
    if( *(_BYTE *)(RegHandle + 103) )
    {
      if( EtwpLevelKeywordEnabled(
             *(_QWORD *)(*(_QWORD *)(RegHandle + 40) + 400i64) + 96i64,
             EventDescriptor->Level,
             EventDescriptor->Keyword) )
      {
        LODWORD(v29) = UserDataCount;
        return EtwpEventWriteFull(
                 *(_ETW_GUID_ENTRY **)(*(_QWORD *)(RegHandle + 32) + 400i64),
                 v27,
                 0i64,
                 v9,
                 EventDescriptor,
                 0,
                 0,
                 ActivityId,
                 RelatedActivityId,
                 v29,
                 v26,
                 0i64,
                 LoggerMask,
                 v28,
                 *(_WORD *)(RegHandle + 98),
                 Traits,
                 &EventKey);
      }
    }
  }
  return v12;
}

Referenced by: