EtwWriteString

VOID __stdcall EtwWriteString(UINT8 ActivityId, GUID *a2){
  unsigned __int64 v2; 
  const _GUID *v3; 
  const _GUID *v4; 
  INT64 v5; 
  UINT8 v6; 
  unsigned __int64 v7; 
  __int64 v8; 
  VOID *Traits; 
  __int64 v10; 
  char v11; 
  UINT64 v12; 
  UINT8 v13; 
  _ETW_GUID_ENTRY *v14; 
  UINT8 v15; 
  _ETW_GUID_ENTRY *GroupEntry; 
  __int64 v17; 
  char v18; 
  UINT8 v19; 
  _ETW_GUID_ENTRY *v20; 
  _ETW_GUID_ENTRY *v21; 
  UINT64 UserDataCount; 
  UINT64 EventKey; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  _EVENT_DESCRIPTOR EventDescriptor; 
  UINT64 LoggerMask[2]; 
  __int128 v27; 
  PCWSTR String; 
  EventKey = 0i64;
  v4 = v3;
  v5 = v2;
  v6 = (unsigned __int8)a2;
  *(_OWORD *)LoggerMask = 0i64;
  v27 = 0i64;
  v7 = ActivityId & (unsigned __int64)-(__int64)(ActivityId != 0i64);
  if( v7 )
  {
    v8 = *(_QWORD *)((ActivityId & (unsigned __int64)-(__int64)(ActivityId != 0i64)) + 0x68);
    *(_QWORD *)&EventDescriptor.Id = 0i64;
    EventDescriptor.Level = (unsigned __int8)a2;
    EventDescriptor.Keyword = v2;
    Traits = (VOID *)((v8 + 28) & -(__int64)(v8 != 0));
    UserData.Ptr = (unsigned __int64)String;
    v10 = -1i64;
    do
      ++v10;
    while( String[v10] );
    v11 = *(_BYTE *)((ActivityId & (unsigned __int64)-(__int64)(ActivityId != 0i64)) + 0x64);
    UserData.Size = 2 * v10 + 2;
    UserData.Reserved = 0;
    if( v11
      && EtwpLevelKeywordEnabled(
           *(_QWORD *)((ActivityId & (unsigned __int64)-(__int64)(ActivityId != 0i64)) + 0x20) + 96i64,
           (UINT8)a2,
           v2) )
    {
      LODWORD(UserDataCount) = 1;
      EtwpEventWriteFull(
        v14,
        v13,
        0i64,
        v12,
        &EventDescriptor,
        4u,
        0,
        v4,
        0i64,
        UserDataCount,
        &UserData,
        0i64,
        LoggerMask,
        0i64,
        *(_WORD *)(v7 + 98),
        Traits,
        &EventKey);
    }
    if( *(_BYTE *)(v7 + 101) && EtwpLevelKeywordEnabled(*(_QWORD *)(v7 + 40) + 96i64, v6, v5) )
    {
      LODWORD(UserDataCount) = 1;
      EtwpEventWriteFull(
        *(_ETW_GUID_ENTRY **)(v7 + 32),
        v15,
        0i64,
        0i64,
        &EventDescriptor,
        4u,
        0,
        v4,
        0i64,
        UserDataCount,
        &UserData,
        0i64,
        LoggerMask,
        GroupEntry,
        *(_WORD *)(v7 + 98),
        Traits,
        &EventKey);
    }
    v17 = *(_QWORD *)(v7 + 32);
    if( *(_QWORD *)(v17 + 400) )
    {
      v18 = *(_BYTE *)(v7 + 102);
      *(_OWORD *)LoggerMask = 0i64;
      v27 = 0i64;
      if( v18 && EtwpLevelKeywordEnabled(*(_QWORD *)(v17 + 400) + 96i64, v6, v5) )
      {
        LODWORD(UserDataCount) = 1;
        EtwpEventWriteFull(
          v20,
          v19,
          0i64,
          0i64,
          &EventDescriptor,
          4u,
          0,
          v4,
          0i64,
          UserDataCount,
          &UserData,
          0i64,
          LoggerMask,
          0i64,
          *(_WORD *)(v7 + 98),
          Traits,
          &EventKey);
      }
      if( *(_BYTE *)(v7 + 103) )
      {
        if( EtwpLevelKeywordEnabled(*(_QWORD *)(*(_QWORD *)(v7 + 40) + 400i64) + 96i64, v6, v5) )
        {
          LODWORD(UserDataCount) = 1;
          EtwpEventWriteFull(
            *(_ETW_GUID_ENTRY **)(*(_QWORD *)(v7 + 32) + 400i64),
            *(_BYTE *)(v7 + 101),
            0i64,
            0i64,
            &EventDescriptor,
            4u,
            0,
            v4,
            0i64,
            UserDataCount,
            &UserData,
            0i64,
            LoggerMask,
            v21,
            *(_WORD *)(v7 + 98),
            Traits,
            &EventKey);
        }
      }
    }
  }
}

Referenced by: