EtwpEnableTrace

INT64 __fastcall EtwpEnableTrace(
        _ETW_SILODRIVERSTATE *SiloState,
        const _GUID *ProviderId,
        const _GUID *SourceId,
        UINT64 TraceHandle,
        UINT64 ControlCode,
        UINT8 Level,
        UINT64 OrKeywordMask,
        UINT64 AndKeywordMask,
        UINT64 EnableProperty,
        _UNICODE_STRING *ScopeFilters,
        _EVENT_FILTER_EVENT_ID **EventFilters){
  _UNICODE_STRING *v11; 
  __int16 v12; 
  int v14; 
  int v15; 
  unsigned int v16; 
  _UNICODE_STRING *v17; 
  int Length; 
  UINT8 **v19; 
  unsigned int v20; 
  _EVENT_FILTER_EVENT_ID **v21; 
  int v22; 
  int v23; 
  int v24; 
  int v25; 
  int v26; 
  int v27; 
  int v28; 
  int v29; 
  unsigned int v30; 
  char *PoolWithTag; 
  char *v32; 
  _GUID v33; 
  unsigned int v34; 
  unsigned int Count; 
  char *v37; 
  unsigned int v38; 
  __int64 v39; 
  unsigned int i; 
  unsigned int j; 
  __int64 v42; 
  int v43; 
  unsigned int v44; 
  __int64 v45; 
  __int64 v46; 
  UINT64 v47; 
  __int64 v48; 
  __int64 v49; 
  __int64 v50; 
  __int64 v51; 
  __int64 v52; 
  UINT8 *Src; 
  unsigned int Size; 
  UINT8 *v57; 
  unsigned int v58; 
  UINT8 *v59; 
  unsigned int v60; 
  __int64 v61; 
  v11 = ScopeFilters;
  v12 = TraceHandle;
  v14 = 0;
  v15 = 120;
  if( ScopeFilters )
  {
    v16 = 0;
    v17 = ScopeFilters;
    do
    {
      Length = v17->Length;
      if( (_WORD)Length && v17->Buffer )
      {
        if( (unsigned __int16)Length > 0x400u )
          return(unsigned int)-1073741811;
        ++v14;
        v15 += Length + 2;
      }
      ++v16;
      ++v17;
    }
    while( v16 < 4 );
  }
  v19 = (UINT8 **)EventFilters;
  if( EventFilters )
  {
    v20 = 0;
    v21 = EventFilters;
    do
    {
      if( *v21 )
      {
        Count = (*v21)->Count;
        if( (_WORD)Count )
        {
          if( Count > 0x40 )
            return(unsigned int)-1073741811;
          ++v14;
          v15 += 2 * Count + 4;
        }
      }
      ++v20;
      ++v21;
    }
    while( v20 < 2 );
  }
  v22 = v14 + 1;
  if( !Size )
    v22 = v14;
  v23 = v15 + Size;
  if( !Size )
    v23 = v15;
  v24 = v22 + 1;
  if( !v58 )
    v24 = v22;
  v25 = v23 + v58;
  if( !v58 )
    v25 = v23;
  v26 = v24 + 1;
  if( !v60 )
    v26 = v24;
  v27 = v25 + v60;
  if( !v60 )
    v27 = v25;
  v28 = v26 + 1;
  if( !v61 )
    v28 = v26;
  v29 = v27 + 24;
  if( !v61 )
    v29 = v27;
  v30 = 16 * v28 + v29;
  PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPool, v30, 0x74777445ui64);
  v32 = PoolWithTag;
  if( PoolWithTag )
  {
    memset((INT64)PoolWithTag, 0i64);
    *(_DWORD *)v32 = 3;
    *((_DWORD *)v32 + 1) = v30;
    if( SourceId )
      *(_GUID *)(v32 + 56) = *SourceId;
    v33 = *ProviderId;
    *((_DWORD *)v32 + 18) = ControlCode;
    v32[76] = Level;
    *((_QWORD *)v32 + 12) = AndKeywordMask;
    *((_QWORD *)v32 + 11) = OrKeywordMask;
    *((_DWORD *)v32 + 20) = EnableProperty;
    *((_WORD *)v32 + 39) = v12;
    *((_DWORD *)v32 + 29) = v28;
    *(_GUID *)(v32 + 40) = v33;
    if( v28 )
    {
      v37 = v32 + 120;
      v38 = 0;
      v39 = (__int64)&v32[16 * v28 + 120];
      for( i = 0; i < 4; ++i )
      {
        if( v11->Length && v11->Buffer )
        {
          if( i )
          {
            if( i == 1 )
            {
              *(_DWORD *)&v37[16 * v38 + 12] = -2147483632;
            }
            else if( i == 2 )
            {
              *(_DWORD *)&v37[16 * v38 + 12] = -2147483616;
            }
            else
            {
              *(_DWORD *)&v37[16 * v38 + 12] = -2147450880;
            }
          }
          else
          {
            *(_DWORD *)&v37[16 * v38 + 12] = -2147483640;
          }
          v46 = 2i64 * v38;
          v47 = (unsigned int)v11->Length + 2;
          *(_DWORD *)&v37[8 * v46 + 8] = v47;
          *(_QWORD *)&v37[8 * v46] = v39 - (_QWORD)v32;
          memmove((UINT8 *)v39, (UINT8 *)v11->Buffer, v47);
          v48 = *(unsigned int *)&v37[16 * v38++ + 8];
          v39 += v48;
        }
        ++v11;
      }
      for( j = 0; j < 2; ++j )
      {
        if( *v19 && *((_WORD *)*v19 + 1) )
        {
          if( j )
            *(_DWORD *)&v37[16 * v38 + 12] = -2147479552;
          else
            *(_DWORD *)&v37[16 * v38 + 12] = -2147483136;
          v42 = 2i64 * v38;
          v43 = *((unsigned __int16 *)*v19 + 1);
          *(_QWORD *)&v37[8 * v42] = v39 - (_QWORD)v32;
          v44 = 2 * v43 + 4;
          *(_DWORD *)&v37[8 * v42 + 8] = v44;
          memmove((UINT8 *)v39, *v19, v44);
          v45 = *(unsigned int *)&v37[16 * v38++ + 8];
          v39 += v45;
        }
        ++v19;
      }
      if( Size )
      {
        v49 = 2i64 * v38;
        *(_DWORD *)&v37[8 * v49 + 8] = Size;
        *(_DWORD *)&v37[8 * v49 + 12] = -2147482624;
        *(_QWORD *)&v37[8 * v49] = v39 - (_QWORD)v32;
        memmove((UINT8 *)v39, Src, Size);
        v39 += *(unsigned int *)&v37[16 * v38++ + 8];
      }
      if( v58 )
      {
        v50 = 2i64 * v38;
        *(_DWORD *)&v37[8 * v50 + 8] = v58;
        *(_DWORD *)&v37[8 * v50 + 12] = -2147475456;
        *(_QWORD *)&v37[8 * v50] = v39 - (_QWORD)v32;
        memmove((UINT8 *)v39, v57, v58);
        v39 += *(unsigned int *)&v37[16 * v38++ + 8];
      }
      if( v60 )
      {
        v51 = 2i64 * v38;
        *(_DWORD *)&v37[8 * v51 + 8] = v60;
        *(_DWORD *)&v37[8 * v51 + 12] = 0x80000000;
        *(_QWORD *)&v37[8 * v51] = v39 - (_QWORD)v32;
        memmove((UINT8 *)v39, v59, v60);
        v39 += *(unsigned int *)&v37[16 * v38++ + 8];
      }
      if( v61 )
      {
        v52 = 2i64 * v38;
        *(_DWORD *)&v37[8 * v52 + 12] = -2147467264;
        *(_DWORD *)&v37[8 * v52 + 8] = 24;
        *(_QWORD *)&v37[8 * v52] = v39 - (_QWORD)v32;
        *(_OWORD *)v39 = *(_OWORD *)v61;
        *(_QWORD *)(v39 + 16) = *(_QWORD *)(v61 + 16);
      }
    }
    v34 = EtwpEnableGuid((__int64)SiloState, (__int64)v32, 0);
    ExFreePoolWithTag(v32, 0);
  }
  else
  {
    return(unsigned int)-1073741801;
  }
  return v34;
}

Referenced by: