EtwpGetTraceGroupInfo

INT64 __fastcall EtwpGetTraceGroupInfo(
        _ETW_SILODRIVERSTATE *SiloState,
        _GUID *Provider,
        VOID *Buffer,
        UINT64 *OutBufferLen){
  unsigned int v4; 
  unsigned int v6; 
  unsigned int v7; 
  int v8; 
  _ETW_GUID_ENTRY *GuidEntryByGuid; 
  _ETHREAD *CurrentThread; 
  __int64 v12; 
  __int64 v13; 
  _OWORD *v14; 
  _TRACE_ENABLE_INFO *EnableInfo; 
  _LIST_ENTRY *Flink; 
  UINT64 v17; 
  char *v18; 
  _ETHREAD *v19; 
  char *v20; 
  __int64 v21; 
  char *v22; 
  int *v23; 
  UINT64 pulResult; 
  UINT64 *v25; 
  v25 = OutBufferLen;
  v4 = *(_DWORD *)OutBufferLen;
  v6 = 0;
  v7 = 0;
  v8 = 0;
  GuidEntryByGuid = EtwpFindGuidEntryByGuid(SiloState, Provider, EtwGroupGuidType);
  if( !GuidEntryByGuid )
    return 3221226133i64;
  memset((INT64)Buffer, 0i64);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  ExAcquirePushLockExclusiveEx((UINT64)&GuidEntryByGuid->Lock, 0i64);
  LODWORD(v12) = 4;
  GuidEntryByGuid->LockOwner = (_ETHREAD *)KeGetCurrentThread();
  v13 = 8i64;
  if( v4 >= 4 )
    *(_DWORD *)Buffer = 8;
  v14 = (char *)Buffer + 4;
  EnableInfo = GuidEntryByGuid->EnableInfo;
  do
  {
    v12 = (unsigned int)(v12 + 32);
    if( (unsigned int)v12 <= v4 )
    {
      *v14 = *(_OWORD *)&EnableInfo->IsEnabled;
      v14[1] = *(_OWORD *)&EnableInfo->MatchAnyKeyword;
      v14 += 2;
    }
    ++EnableInfo;
    --v13;
  }
  while( v13 );
  Flink = GuidEntryByGuid->RegListHead.Flink;
  v23 = (int *)((char *)Buffer + v12);
  v17 = (unsigned int)(v12 + 4);
  v18 = (char *)Buffer + (unsigned int)v17;
  LODWORD(pulResult) = v17;
  v22 = v18;
  while( Flink != &GuidEntryByGuid->RegListHead )
  {
    if( RtlULongAdd(v17, 0x10ui64, &pulResult) < 0 )
    {
      v6 = -2147483643;
      goto LABEL_29;
    }
    v17 = (unsigned int)pulResult;
    ++v7;
    if( (unsigned int)pulResult <= v4 )
    {
      v19 = (_ETHREAD *)KeGetCurrentThread();
      --*((_WORD *)v19 + 242);
      ExAcquirePushLockExclusiveEx((UINT64)&Flink[1].Flink[25].Blink, 0i64);
      Flink[1].Flink[26].Flink = (_LIST_ENTRY *)KeGetCurrentThread();
      *(_OWORD *)v22 = *(_OWORD *)&Flink[1].Flink[2].Blink;
      Flink[1].Flink[26].Flink = 0i64;
      ExReleasePushLockEx((UINT64)&Flink[1].Flink[25].Blink, 0i64);
      KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
      v22 += 16;
      v17 = (unsigned int)pulResult;
    }
    Flink = Flink->Flink;
  }
  if( (unsigned int)v17 > v4 )
  {
    v6 = -1073741789;
  }
  else
  {
    if( v7 == 1 )
    {
      v8 = 1;
    }
    else if( v7 > 1 )
    {
      qsort((WCHAR *)v18, v7, (const WCHAR *)0x10, EtwpCompareGuid);
      v20 = v18 + 16;
      v8 = 1;
      v21 = v7 - 1;
      do
      {
        if( *(_QWORD *)v20 != *(_QWORD *)v18 || *((_QWORD *)v20 + 1) != *((_QWORD *)v18 + 1) )
        {
          v18 += 16;
          if( v18 != v20 )
            *(_OWORD *)v18 = *(_OWORD *)v20;
          ++v8;
        }
        v20 += 16;
        --v21;
      }
      while( v21 );
    }
    *v23 = v8;
  }
LABEL_29:
  GuidEntryByGuid->LockOwner = 0i64;
  ExReleasePushLockEx((UINT64)&GuidEntryByGuid->Lock, 0i64);
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  EtwpUnreferenceGuidEntry(GuidEntryByGuid);
  *(_DWORD *)v25 = pulResult;
  return v6;
}

Referenced by: