EtwpWriteUserEvent
INT64 __fastcall EtwpWriteUserEvent(
_ETW_GUID_ENTRY *GuidEntry,
UINT8 RegEntryEnableMask,
UINT64 HeaderType,
UINT64 Filter,
UINT64 Flags,
_EVENT_HEADER *UserEventHeader,
_GUID *RelatedActivityId,
UINT64 Level,
UINT64 Keyword,
UINT64 UserDataCount,
_EVENT_DATA_DESCRIPTOR *UserData,
UINT64 *LoggerMask,
_ETW_GUID_ENTRY *GroupEntry,
UINT8 UseDescriptorType,
VOID *Traits,
UINT64 *EventKey){
char v16;
_ETW_GUID_ENTRY *v19;
unsigned int v20;
__int16 v21;
UINT8 v22;
bool v23;
__int64 v24;
__int64 v25;
_ETW_GUID_ENTRY *v26;
INT64 v27;
int v28;
INT64 v29;
UINT8 v30;
unsigned int v31;
__int64 v32;
_ETW_FILTER_HEADER *FilterData;
_EVENT_DATA_DESCRIPTOR *v34;
unsigned int v35;
__int64 v36;
INT64 v37;
INT64 v38;
unsigned int **v40;
UINT64 v41;
int v42;
unsigned int v43;
int v44;
unsigned int v45;
_OWORD *v46;
UINT64 v47;
__int64 v48;
unsigned int v49;
unsigned int v50;
UINT64 v51;
unsigned int v52;
char v53;
__int64 v54;
INT64 v55;
char v56;
INT64 v57;
__int64 v58;
INT64 v59;
unsigned int v60;
unsigned __int16 *v61;
_OWORD *v62;
__int128 v63;
unsigned int v64;
UINT8 *v65;
int v66;
__int64 v67;
UINT64 ProcessStartKey;
__int64 v69;
__int64 v70;
UINT64 v71;
unsigned int v72;
__int64 v73;
__int64 v74;
__int64 v75;
unsigned __int16 *v76;
UINT8 *v77;
unsigned int v78;
__int16 v79;
UINT64 v80;
UINT8 *v81;
int v82;
unsigned int v83;
int v84;
int v85;
unsigned __int16 *v86;
__int64 v87;
UINT8 *v88;
__int64 v89;
__int64 v90;
__int64 v91;
__int64 v92;
UINT8 *v93;
unsigned __int16 *v94;
UINT8 *v95;
UINT8 *v96;
_DWORD *v97;
INT64 v98;
INT64 v99;
unsigned int ReserveTraceBufferStatus;
EVENT_DESCRIPTOR *v101;
_ETW_GUID_ENTRY *v102;
__int64 v103;
int v104;
char v105;
char v106;
char v107;
void *v108;
void *v109;
UINT8 *v110;
int v111;
char v112;
char v113[400];
UINT64 v114;
UINT64 v115;
INT64 v116;
char v117;
char v118;
UINT8 v119;
int v120;
int v121;
__int16 v122;
int Status;
unsigned __int16 Status_4;
char v125;
unsigned __int16 v126;
unsigned __int16 *v127;
int v128;
INT64 v129;
INT64 v130;
unsigned __int16 v131;
INT64 v132;
__int64 v133;
unsigned __int16 *v134;
INT64 StackLookasideListEntry;
UINT64 v136;
char v137;
char v138;
unsigned int v139;
unsigned int v140;
INT64 v141;
_ETW_SILODRIVERSTATE *SiloState;
unsigned int v143;
unsigned int v144;
unsigned int v145;
UINT8 *dst;
UINT64 v147;
UINT8 *v148;
INT64 CurrentThread;
INT64 v150;
unsigned __int64 HighLimit;
unsigned __int64 LowLimit;
UINT64 v153;
UINT64 v154;
UINT16 *v155;
__int64 v156;
UINT64 *v157;
UINT8 *v158;
unsigned __int64 v159;
UINT64 *v160;
_ETW_SILODRIVERSTATE *v161;
_ETW_GUID_ENTRY *v162;
INT64 v163[2];
__int64 v164;
_ETHREAD *v165;
_ETHREAD *v166;
_ETHREAD *v167;
_OWORD result[24];
unsigned int v169;
__int16 Src[40];
v16 = Filter;
v131 = HeaderType;
v130 = (INT64)GuidEntry;
v19 = GroupEntry;
v162 = GuidEntry;
v129 = (INT64)UserEventHeader;
v136 = (UINT64)UserData;
v160 = LoggerMask;
v158 = (UINT8 *)Traits;
v157 = EventKey;
v20 = 0;
Status = 0;
memset((INT64)result, 0i64);
v139 = 0;
memset((INT64)Src, 0i64);
StackLookasideListEntry = 0i64;
v148 = 0i64;
v126 = 0;
v155 = 0i64;
v147 = 0i64;
v156 = PsGetCurrentServerSiloGlobals()[108];
v21 = UseDescriptorType & 0x200;
v122 = UseDescriptorType & 0x200;
if( UserData )
{
if( !(_DWORD)UserDataCount )
return 3221225485i64;
}
else if( (_DWORD)UserDataCount )
{
return 3221225485i64;
}
if( (unsigned int)UserDataCount > 0x80 )
return 3221225485i64;
if( !GroupEntry )
v19 = GuidEntry;
v150 = (INT64)v19;
v118 = 0;
SiloState = GuidEntry->SiloState;
v161 = SiloState;
if( v157 && *v157 )
{
v147 = *v157;
v118 = 16;
}
DecodeProviderTraits((UINT16 *)v158, (UseDescriptorType & 0x400) != 0, &v126, &v155);
CurrentThread = (INT64)KeGetCurrentThread();
--*(_WORD *)(CurrentThread + 484);
v22 = ~v16 & RegEntryEnableMask;
while( 1 )
{
LABEL_10:
v23 = !_BitScanForward((unsigned int *)&v24, v22);
v139 = v24;
if( v23 )
{
v36 = (__int64)SiloState;
LABEL_21:
v37 = v130;
v38 = v129;
goto LABEL_22;
}
v132 = 1i64;
*(_OWORD *)v163 = 0i64;
v164 = 0i64;
v141 = 0i64;
v120 = 80;
v140 = 0;
v125 = 0;
Status_4 = 0;
v128 = 0;
dst = 0i64;
v159 = 0i64;
v22 &= v22 - 1;
v119 = v22;
v25 = (unsigned int)v24;
v26 = (_ETW_GUID_ENTRY *)v150;
v27 = v150 + 32 * (v24 + 4);
if( v160 )
{
v28 = *((_DWORD *)v160 + (*(unsigned __int16 *)(v27 + 6) >> 5));
if( _bittest(&v28, *(_WORD *)(v27 + 6) & 0x1F) )
continue;
}
if( !EtwpLevelKeywordEnabled(v27, Level, Keyword) )
continue;
v32 = *((_QWORD *)KeGetCurrentThread() + 23);
if( ((Flags & 2) != 0 || *(int *)(v32 + 1120) < 0) && (*(_DWORD *)(v27 + 8) & 0x200) != 0 )
continue;
FilterData = v26->FilterData;
if( FilterData
&& ((FilterData[v25].FilterFlags & 0x80000200) == -2147483136
|| (FilterData[v25].FilterFlags & 0x80000100) == -2147483392) )
{
v34 = (_EVENT_DATA_DESCRIPTOR *)v136;
LODWORD(v114) = v31;
v35 = v139;
if( !EtwpApplyEventIdPayloadFilterOnUserEvent((INT64)v26, v139, v131, v129, v114, v136) )
goto LABEL_19;
v31 = UserDataCount;
v29 = Keyword;
v30 = Level;
}
else
{
v35 = v139;
v34 = (_EVENT_DATA_DESCRIPTOR *)v136;
}
if( v21 && EtwpIsEventNameFilterEnabled((INT64)v26, v35, v30, v29, 0) )
{
v117 = 0;
LOBYTE(v116) = Level;
LOBYTE(v115) = 0;
LOBYTE(v114) = 1;
if( !(unsigned __int8)EtwpApplyEventNameFilter(v26, v35, v31, v34, v114, v115, v116, v41) )
{
LABEL_19:
v22 = v119;
continue;
}
v31 = UserDataCount;
}
v42 = 0;
if( RelatedActivityId )
{
v43 = 104;
v120 = 104;
v42 = 8;
}
else
{
v43 = v120;
}
v44 = *(_DWORD *)(v27 + 8);
if( (v44 & 0xFFFFFF9F) != 0 )
{
if( (v44 & 0x800) != 0 && v156 != EtwpHostSiloState )
{
v42 |= 0x80u;
v43 += (*(unsigned __int16 *)(v156 + 4200) + 15) & 0xFFFFFFF8;
v120 = v43;
}
if( (v44 & 1) != 0 )
{
if( (v118 & 2) == 0 )
{
EtwpGetSidExtendedHeaderItem((INT64)Src);
v118 |= 2u;
v44 = *(_DWORD *)(v27 + 8);
v31 = UserDataCount;
}
v42 |= 2u;
v43 += (unsigned __int16)Src[0];
v120 = v43;
}
if( (v44 & 2) != 0 )
{
v42 |= 1u;
v43 += 16;
v120 = v43;
}
if( (v44 & 0x80u) != 0 )
{
v42 |= 0x20u;
v43 += 16;
v120 = v43;
}
if( (v44 & 0x100) != 0 )
{
v42 |= 0x40u;
v43 += 16;
v120 = v43;
}
if( (v44 & 4) == 0 )
goto LABEL_47;
v102 = (_ETW_GUID_ENTRY *)v150;
v103 = *(_QWORD *)(v150 + 384);
if( !v103 )
goto LABEL_197;
v104 = *(_DWORD *)(104 * v25 + v103);
if( (v104 & 0x80001000) != -2147479552
&& (v104 & 0x80002000) != -2147475456
&& (v104 & 0x80004000) != -2147467264 )
{
goto LABEL_197;
}
LOBYTE(v114) = 1;
EtwpApplyLevelKwFilter((_WMI_LOGGER_CONTEXT *)v150);
if( v105 && EtwpApplyStackWalkFilterOnUserEvent(v129, (INT64)v102, v35) )
{
v117 = 1;
LOBYTE(v116) = Level;
LOBYTE(v115) = 0;
LOBYTE(v114) = 1;
v106 = EtwpApplyEventNameFilter(
v102,
v35,
(unsigned int)UserDataCount,
(_EVENT_DATA_DESCRIPTOR *)v136,
v114,
v115,
v116,
Keyword);
v31 = UserDataCount;
if( v106 )
{
LABEL_197:
v107 = v118;
if( (v118 & 1) == 0 )
{
StackLookasideListEntry = (INT64)EtwpGetStackLookasideListEntry();
if( StackLookasideListEntry )
{
EtwpGetStackExtendedHeaderItem(CurrentThread, 0, 0x100ui64, (INT64)&StackLookasideListEntry, 0, 0i64);
v118 = (StackLookasideListEntry != 0 ? 8 : 0) | v107 & 0xF7;
}
else
{
HighLimit = 0i64;
LowLimit = 0i64;
IoGetStackLimits(&LowLimit, &HighLimit);
if( (unsigned __int64)&HighLimit - LowLimit > 0x1440 )
{
v108 = alloca(1552i64);
StackLookasideListEntry = (INT64)&v112;
EtwpGetStackExtendedHeaderItem(CurrentThread, 0, 0xC0ui64, (INT64)&StackLookasideListEntry, 0, 0i64);
}
}
v118 |= 1u;
v31 = UserDataCount;
}
if( StackLookasideListEntry )
{
v42 |= 4u;
v43 += *(unsigned __int16 *)StackLookasideListEntry;
v120 = v43;
}
}
}
else
{
v31 = UserDataCount;
}
LABEL_47:
if( (*(_DWORD *)(v27 + 8) & 8) != 0 )
{
if( (v118 & 4) != 0 )
{
v110 = v148;
}
else
{
v153 = 0i64;
v154 = 0i64;
IoGetStackLimits(&v154, &v153);
if( (unsigned __int64)&v153 - v154 <= 0x1E0 )
{
v110 = v148;
}
else
{
v109 = alloca(480i64);
v110 = (UINT8 *)v113;
v148 = (UINT8 *)v113;
EtwpGetPsmKeyExtendedHeaderItem((__int64)v113);
}
v118 |= 4u;
v31 = UserDataCount;
}
if( v110 )
{
v42 |= 0x10u;
v43 += *(unsigned __int16 *)v110;
v120 = v43;
}
}
}
v45 = *(unsigned __int16 *)(v27 + 6);
v145 = v45;
v46 = &result[3 * v169];
if( v31 )
break;
LABEL_72:
if( v128 )
{
v43 += (Status_4 + 15) & 0xFFFFFFF8;
v120 = v43;
}
if( v126 )
{
v43 += (v126 + 15) & 0xFFFFFFF8;
v120 = v43;
}
*((_DWORD *)v46 + 10) = v43;
v54 = v45;
v36 = (__int64)SiloState;
if( ExAcquireRundownProtectionCacheAwareEx(SiloState->EtwpLoggerRundown[v54], 1u) )
{
if( v45 >= *(_DWORD *)(v36 + 16) )
{
v55 = 1i64;
}
else
{
_mm_lfence();
v55 = *(_QWORD *)(v54 * 8 + *(_QWORD *)(v36 + 456));
v43 = v120;
}
v132 = v55;
v56 = 1;
}
else
{
v56 = v125;
v55 = v132;
}
if( (v55 & 1) != 0 )
{
if( v56 )
ExReleaseRundownProtectionCacheAwareEx(
*(PEX_RUNDOWN_REF_CACHE_AWARE *)(*(_QWORD *)(v36 + 448) + 8i64 * v45),
1u);
v23 = v45 == 3;
v21 = v122;
v22 = v119;
if( v23 )
{
v111 = -1073741058;
if( !*(_DWORD *)(v36 + 4068) )
v111 = -1073741816;
Status = v111;
goto LABEL_21;
}
}
else
{
v57 = EtwpReserveTraceBuffer((UINT64 *)v55, v43, (INT64)v163, &v141, 0);
v58 = v57;
v133 = v57;
if( v57 )
{
v59 = v132;
*(_QWORD *)v46 = v132;
*((_QWORD *)v46 + 1) = v57;
v46[1] = *(_OWORD *)v163;
*((_QWORD *)v46 + 4) = v164;
++v169;
v144 = 0;
v60 = 80;
LODWORD(v127) = 80;
v121 = 80;
v61 = 0i64;
v134 = 0i64;
v62 = (_OWORD *)v129;
*(_OWORD *)v58 = *(_OWORD *)v129;
*(_OWORD *)(v58 + 16) = v62[1];
*(_OWORD *)(v58 + 32) = v62[2];
*(_OWORD *)(v58 + 48) = v62[3];
*(_OWORD *)(v58 + 64) = v62[4];
if( v155 )
{
v63 = *(_OWORD *)v155;
*(_WORD *)(v58 + 4) |= 0x80u;
}
else
{
v63 = *(_OWORD *)(v130 + 40);
}
*(_OWORD *)(v58 + 24) = v63;
*(_DWORD *)v58 = v43 | *(_DWORD *)(v59 + 4i64 * v131 + 20);
v64 = 80;
if( v42 )
{
if( (v42 & 0x80u) != 0 )
{
v61 = (unsigned __int16 *)(v58 + 80);
v91 = v156;
*(_WORD *)(v58 + 80) = (*(_WORD *)(v156 + 4200) + 15) & 0xFFF8;
*(_WORD *)(v58 + 82) = 16;
*(_WORD *)(v58 + 86) = *(_WORD *)(v91 + 4200);
*(_WORD *)(v58 + 84) &= ~1u;
*(_WORD *)(v58 + 84) &= 1u;
v92 = v58 + 88;
memmove((UINT8 *)(v58 + 88), *(UINT8 **)(v91 + 4192), *(unsigned __int16 *)(v91 + 4200));
memset(v92 + *(unsigned __int16 *)(v91 + 4200), 0i64);
v58 = v133;
*(_WORD *)(v133 + 4) |= 1u;
v60 = *v61 + 80;
LODWORD(v127) = v60;
v121 = v60;
v134 = v61;
v64 = v60;
}
if( (v42 & 8) != 0 )
{
v90 = v58 + v64;
*(_DWORD *)v90 = 65560;
*(_WORD *)(v90 + 6) = 16;
*(_WORD *)(v90 + 4) &= ~1u;
*(_WORD *)(v90 + 4) &= 1u;
*(_GUID *)(v90 + 8) = *RelatedActivityId;
*(_WORD *)(v58 + 4) |= 1u;
v60 = v64 + 24;
LODWORD(v127) = v64 + 24;
v121 = v64 + 24;
if( v61 )
v61[2] |= 1u;
v61 = (unsigned __int16 *)(v58 + v64);
v134 = v61;
v64 += 24;
}
if( (v42 & 2) != 0 )
{
v65 = (UINT8 *)(v58 + v64);
v66 = (unsigned __int16)Src[0];
memmove(v65, (UINT8 *)Src, (unsigned __int16)Src[0]);
v58 = v133;
*(_WORD *)(v133 + 4) |= 1u;
v60 = v66 + v64;
LODWORD(v127) = v66 + v64;
v121 = v66 + v64;
if( v61 )
v61[2] |= 1u;
v61 = (unsigned __int16 *)v65;
v134 = (unsigned __int16 *)v65;
v64 += v66;
}
if( (v42 & 1) != 0 )
{
v89 = v58 + v64;
*(_DWORD *)v89 = 196624;
*(_WORD *)(v89 + 6) = 4;
*(_WORD *)(v89 + 4) &= ~1u;
*(_WORD *)(v89 + 4) &= 1u;
*(_DWORD *)(v89 + 8) = PsGetCurrentProcessSessionId();
v58 = v133;
*(_WORD *)(v133 + 4) |= 1u;
v60 = v64 + 16;
LODWORD(v127) = v64 + 16;
v121 = v64 + 16;
if( v61 )
v61[2] |= 1u;
v61 = (unsigned __int16 *)v89;
v134 = (unsigned __int16 *)v89;
v64 += 16;
}
if( (v42 & 0x20) != 0 )
{
v67 = v58 + v64;
*(_DWORD *)v67 = 851984;
*(_WORD *)(v67 + 6) = 8;
*(_WORD *)(v67 + 4) &= ~1u;
*(_WORD *)(v67 + 4) &= 1u;
v166 = (_ETHREAD *)KeGetCurrentThread();
ProcessStartKey = PsGetProcessStartKey(*((_QWORD *)v166 + 23));
*(_QWORD *)(v69 + 8) = ProcessStartKey;
*(_WORD *)(v58 + 4) |= 1u;
v60 = v64 + 16;
LODWORD(v127) = v64 + 16;
v121 = v64 + 16;
if( v61 )
v61[2] |= 1u;
v61 = (unsigned __int16 *)v69;
v134 = (unsigned __int16 *)v69;
v64 += 16;
v43 = v120;
}
if( (v42 & 0x40) != 0 )
{
v70 = v58 + v64;
*(_DWORD *)v70 = 655376;
*(_WORD *)(v70 + 6) = 8;
*(_WORD *)(v70 + 4) &= ~1u;
*(_WORD *)(v70 + 4) &= 1u;
if( (v118 & 0x10) != 0 || (EtwpCreateEventKey(&v147), v118 |= 0x10u, !v157) )
{
v71 = v147;
}
else
{
v71 = v147;
*v157 = v147;
}
*(_QWORD *)(v70 + 8) = v71;
*(_WORD *)(v58 + 4) |= 1u;
v60 = v64 + 16;
LODWORD(v127) = v64 + 16;
v121 = v64 + 16;
if( v61 )
v61[2] |= 1u;
v61 = (unsigned __int16 *)v70;
v134 = (unsigned __int16 *)v70;
v64 += 16;
}
if( (v42 & 4) != 0 )
{
v93 = (UINT8 *)(v58 + v64);
v94 = (unsigned __int16 *)StackLookasideListEntry;
memmove(v93, (UINT8 *)StackLookasideListEntry, *(unsigned __int16 *)StackLookasideListEntry);
v58 = v133;
*(_WORD *)(v133 + 4) |= 1u;
v60 = v64 + *v94;
LODWORD(v127) = v60;
v64 = v60;
v121 = v60;
if( v61 )
v61[2] |= 1u;
v61 = (unsigned __int16 *)v93;
v134 = (unsigned __int16 *)v93;
}
if( (v42 & 0x10) != 0 )
{
v95 = (UINT8 *)(v58 + v64);
v96 = v148;
memmove(v95, v148, *(unsigned __int16 *)v148);
v58 = v133;
*(_WORD *)(v133 + 4) |= 1u;
v60 = v64 + *(unsigned __int16 *)v96;
LODWORD(v127) = v60;
v64 = v60;
v121 = v60;
if( v61 )
v61[2] |= 1u;
v61 = (unsigned __int16 *)v95;
v134 = (unsigned __int16 *)v95;
}
}
v72 = v126;
if( v126 )
{
v73 = v58 + v64;
v127 = (unsigned __int16 *)v73;
*(_WORD *)v73 = (v126 + 15) & 0xFFF8;
*(_WORD *)(v73 + 2) = 12;
*(_WORD *)(v73 + 6) = v72;
*(_WORD *)(v73 + 4) &= ~1u;
*(_WORD *)(v73 + 4) &= 1u;
v74 = v73 + 8;
v75 = v72;
memmove((UINT8 *)(v73 + 8), v158, v72);
memset(v75 + v74, 0i64);
v58 = v133;
*(_WORD *)(v133 + 4) |= 1u;
v76 = v127;
v60 = v64 + *v127;
LODWORD(v127) = v60;
v64 = v60;
v121 = v60;
if( v61 )
v61[2] |= 1u;
v61 = v76;
v134 = v76;
}
if( v128 )
{
v86 = (unsigned __int16 *)(v58 + v64);
v87 = Status_4;
*v86 = (Status_4 + 15) & 0xFFF8;
v86[1] = 11;
v86[3] = v87;
v86[2] &= ~1u;
v86[2] &= 1u;
v77 = (UINT8 *)(v86 + 4);
dst = (UINT8 *)(v86 + 4);
v159 = (unsigned __int64)v86 + v87 + 8;
memset(v159, 0i64);
v58 = v133;
*(_WORD *)(v133 + 4) |= 1u;
v60 = v64 + *v86;
LODWORD(v127) = v60;
v121 = v60;
if( v61 )
v61[2] |= 1u;
}
else
{
v77 = dst;
}
v78 = 0;
v79 = v122;
while( 1 )
{
while( 1 )
{
v144 = v78;
if( v78 >= (unsigned int)UserDataCount )
{
if( v160 )
*((_DWORD *)v160 + (v145 >> 5)) |= 1 << (v145 & 0x1F);
*(_QWORD *)(v58 + 16) = v141;
v97 = (_DWORD *)CurrentThread;
*(_DWORD *)(v58 + 56) = *(_DWORD *)(CurrentThread + 652);
*(_DWORD *)(v58 + 60) = v97[183];
*(_DWORD *)(v58 + 8) = v97[288];
*(_DWORD *)(v58 + 12) = v97[286];
v98 = v132;
if( (*(_DWORD *)(v132 + 12) & 0x80000) != 0
&& (!(_BYTE)KdDebuggerNotPresent && !KdPitchDebugger || KdEventLoggingPresent) )
{
EtwpSendTraceEvent(v132, (INT64)v163);
}
v21 = v79;
v22 = v119;
if( *(_QWORD *)(v98 + 1272) )
EtwpInvokeEventCallback(v98, (INT64)v163, v130 + 40);
goto LABEL_10;
}
v80 = *(unsigned int *)(v136 + 16i64 * v78 + 8);
v81 = *(UINT8 **)(v136 + 16i64 * v78);
if( v79 )
{
LOBYTE(v82) = *(_BYTE *)(v136 + 16i64 * v78 + 12);
v43 = v120;
v77 = dst;
v60 = v121;
LODWORD(v127) = v121;
}
else
{
LOBYTE(v82) = 0;
}
v82 = (unsigned __int8)v82;
if( (_BYTE)v82 )
break;
v83 = v80 + v60;
if( (unsigned int)v80 + v60 < v60 )
{
v121 = -1;
v84 = -1073741675;
v83 = -1;
}
else
{
v121 = v80 + v60;
v84 = 0;
}
if( v84 || v83 > v43 )
{
LABEL_167:
Status = -1073741820;
*(_DWORD *)v58 = v43 | *(_DWORD *)(v132 + 28);
*(_QWORD *)(v58 + 16) = v141;
v22 = v119;
v37 = v130;
v36 = (__int64)SiloState;
v38 = v129;
goto LABEL_22;
}
v167 = (_ETHREAD *)KeGetCurrentThread();
v138 = *((_BYTE *)v167 + 562);
if( v138 && (_DWORD)v80 && ((unsigned __int64)&v81[v80] > 0x7FFFFFFF0000i64 || &v81[v80] < v81) )
MEMORY[0x7FFFFFFF0000] = 0;
memmove((UINT8 *)(v58 + v60), v81, v80);
v43 = v120;
v77 = dst;
v60 = v121;
LODWORD(v127) = v121;
LABEL_126:
++v78;
v58 = v133;
}
v85 = v82 - 1;
if( v85 )
{
if( v85 == 2 )
{
if( (_DWORD)v80 == 8 )
{
if( (unsigned __int64)(v81 + 8) > 0x7FFFFFFF0000i64 || v81 + 8 < v81 )
MEMORY[0x7FFFFFFF0000] = 0;
v141 = *(_QWORD *)v81;
}
goto LABEL_126;
}
++v78;
v58 = v133;
}
else
{
if( !v77 )
goto LABEL_167;
v88 = &v77[v80];
if( &v77[v80] < v77 || (unsigned __int64)v88 > v159 || !v128 )
goto LABEL_167;
if( (_DWORD)v80 && ((unsigned __int64)&v81[v80] > 0x7FFFFFFF0000i64 || &v81[v80] < v81) )
MEMORY[0x7FFFFFFF0000] = 0;
memmove(v77, v81, v80);
v77 = v88;
dst = v88;
--v128;
v60 = (unsigned int)v127;
++v78;
v58 = v133;
}
}
}
v99 = v132;
ReserveTraceBufferStatus = EtwpGetReserveTraceBufferStatus(v132, v43);
if( EtwEventEnabled(EtwpEventTracingProvRegHandle, (EVENT_DESCRIPTOR *)&ETW_EVENT_LOST_EVENT, v101) )
EtwpTraceLostEvent(
(GUID *)(v130 + 40),
(EVENT_DESCRIPTOR *)(v129 + 40),
(UNICODE_STRING *)(v99 + 152),
ReserveTraceBufferStatus,
(UNICODE_STRING *)v114,
v115);
if( Status >= 0 && (*(_DWORD *)(v99 + 12) & 0x8000000) == 0 )
Status = ReserveTraceBufferStatus;
ExReleaseRundownProtectionCacheAwareEx(*(PEX_RUNDOWN_REF_CACHE_AWARE *)(*(_QWORD *)(v36 + 448) + 8i64 * v45), 1u);
v21 = v122;
v22 = v119;
if( ReserveTraceBufferStatus == -1073741675 )
{
Status = -1073741675;
goto LABEL_21;
}
}
}
v143 = 0;
v165 = (_ETHREAD *)KeGetCurrentThread();
v137 = *((_BYTE *)v165 + 562);
v47 = v136;
if( v137 )
{
v48 = 16i64 * v31;
if( v48 )
{
if( (v136 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( v136 + v48 > 0x7FFFFFFF0000i64 || v136 + v48 < v136 )
MEMORY[0x7FFFFFFF0000] = 0;
}
}
v49 = 0;
v43 = v120;
while( 1 )
{
v143 = v49;
if( v49 >= v31 )
{
v45 = v145;
goto LABEL_72;
}
v50 = v43;
v51 = 16i64 * v49 + v47;
v140 = *(_DWORD *)(v51 + 8);
v52 = v140;
if( v140 > 0xFFFF )
{
Status = -2147483643;
v22 = v119;
v37 = v130;
v36 = (__int64)SiloState;
v38 = v129;
goto LABEL_22;
}
if( v122 )
{
v53 = *(_BYTE *)(v51 + 12);
v52 = v140;
}
else
{
v53 = 0;
}
if( v53 )
{
if( v53 == 1 )
{
Status_4 += v52;
++v128;
}
v43 = v120;
}
else
{
v43 = v52 + v120;
v120 += v52;
}
if( v43 < v50 )
break;
++v49;
v47 = v136;
}
Status = -2147483643;
v22 = v119;
v37 = v130;
v36 = (__int64)SiloState;
v38 = v129;
LABEL_22:
if( (v118 & 8) != 0 )
{
RtlpInterlockedPushEntrySList((PSLIST_HEADER)&EtwpStackLookAsideList, (PSLIST_ENTRY)(StackLookasideListEntry - 16));
v37 = v130;
v38 = v129;
}
if( Status < 0 )
{
LODWORD(v115) = Status;
EtwpFailLogging(Level, Keyword, v37, (INT64)result, v22, v115, (EVENT_DESCRIPTOR *)(v38 + 40), 1);
}
else
{
while( v20 < v169 )
{
EtwpReleaseTraceBuffer((INT64 *)&result[3 * v20 + 1]);
ExReleaseRundownProtectionCacheAwareEx(
*(PEX_RUNDOWN_REF_CACHE_AWARE *)(*(_QWORD *)(v36 + 448) + 8i64 * **v40),
1u);
++v20;
}
}
KeLeaveCriticalRegionThread(CurrentThread);
return(unsigned int)Status;
}Referenced by:
NtTraceEvent