EtwActivityIdControl

NTSTATUS __stdcall EtwActivityIdControl(ULONG ControlCode, LPGUID ActivityId){
  __int64 v2; 
  _ETHREAD *CurrentThread; 
  __int64 v5; 
  __int64 v6; 
  GUID *v7; 
  ULONG v8; 
  __int16 v9; 
  ULONG v10; 
  ULONG v11; 
  __int64 v12; 
  GUID v13; 
  NTSTATUS v14; 
  _QWORD *v15; 
  v14 = 0;
  if( ControlCode == 3 )
  {
    v2 = *((_QWORD *)KeGetCurrentPrcb() + 4197);
    *(_QWORD *)ActivityId->Data4 = _InterlockedIncrement64((volatile signed __int64 *)(v2 + 8));
    *(_QWORD *)&ActivityId->Data1 = *(_QWORD *)v2;
    return v14;
  }
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  if( (*((_DWORD *)CurrentThread + 29) & 0x400) != 0 || *((_BYTE *)CurrentThread + 586) == 1 )
    v5 = 0i64;
  else
    v5 = *((_QWORD *)CurrentThread + 30);
  if( v5 )
  {
    v15 = (_QWORD *)(v5 + 5904);
    v6 = *(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1408i64);
    if( v6 && ((v9 = *(_WORD *)(v6 + 8), v9 == 332) || v9 == 452) )
    {
      v7 = (GUID *)(v5 + 12112);
      v15 = (_QWORD *)(v5 + 12112);
    }
    else
    {
      v7 = (GUID *)(v5 + 5904);
    }
    v8 = ControlCode - 1;
    if( v8 )
    {
      v10 = v8 - 1;
      if( v10 )
      {
        v11 = v10 - 2;
        if( v11 )
        {
          if( v11 == 1 )
          {
            *ActivityId = *v7;
            v12 = *((_QWORD *)KeGetCurrentPrcb() + 4197);
            v15[1] = _InterlockedIncrement64((volatile signed __int64 *)(v12 + 8));
            *v15 = *(_QWORD *)v12;
          }
          else
          {
            return -1073741811;
          }
        }
        else
        {
          v13 = *v7;
          *v7 = *ActivityId;
          *ActivityId = v13;
        }
      }
      else
      {
        *v7 = *ActivityId;
      }
    }
    else
    {
      *ActivityId = *v7;
    }
    return v14;
  }
  return -1073741637;
}

Referenced by: