Function at 0x1400073fc
Capabilities:
Check if file exists
Delete file

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x610
mov qword [r11 - 0x138], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1400a12e0]
xor rax, rsp
mov qword [rsp + 0x600], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0xf0], rcx
mov qword [rsp + 0x100], rdx
xor edi, edi
mov r15d, edi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xa0], xmm0
mov qword [r11 - 0x588], rdi
movdqu xmmword [rsp + 0x58], xmm0
lea r12d, [rdi + 0x68]
mov ecx, r12d
call fcn.1400067c4
mov rcx, rax
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x50], dil
mov r14, qword [rsi]
add r14, 0xf8
mov qword [rsp + 0xe8], r14
mov rdx, qword [r14]
jmp 0x1400074c1
mov rax, qword [rdx]
cmp byte [rax + 0x89], dil
jne 0x1400074c9
add rdx, 8
cmp rdx, qword [r14 + 8]
jne 0x1400074b1
jmp 0x1400074ce
mov byte [rsp + 0x50], 1
test rbx, rbx
je 0x14000889b
cmp qword [rbx + 0x30], rdi
je 0x14000889b
cmp qword [rbx + 0x28], rdi
je 0x14000889b
lea rcx, [rsp + 0x58]
xor eax, eax
lock cmpxchg qword [0x1400b6860], rcx
je 0x140007545
mov rax, qword [rsp + 0x58]
mov rsi, qword [rax + 8]
jmp 0x140007535
mov r8, qword [rsi + 0x10]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.140012934
mov rbx, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x20]
call fcn.140006700
mov rdx, r12
mov rcx, rbx
call fcn.140050978
cmp byte [rsi + 0x19], dil
je 0x140007508
mov esi, 0x139f
jmp 0x14000887c
mov byte [rsp + 0x91], 1
mov al, byte [rbx + 1]
mov byte [0x1400a1c37], al
mov al, byte [rbx + 2]
mov byte [0x1400a1309], al
mov al, byte [rbx + 6]
mov byte [0x1400a1c32], al
mov al, byte [rbx + 3]
mov byte [0x1400a1c36], al
mov al, byte [rbx + 4]
mov byte [0x1400a1308], al
mov cl, byte [rbx + 5]
mov byte [0x1400a1c35], cl
mov al, byte [rbx]
mov byte [0x1400a1c34], al
mov rax, qword [rbx + 0x30]
mov qword [0x1400a1c38], rax
mov al, byte [rbx + 7]
mov byte [0x1400a1c33], al
mov al, byte [rbx + 8]
mov byte [0x1400a1c31], al
mov al, byte [rbx + 9]
mov byte [0x1400a1c30], al
mov rax, qword [rbx + 0x38]
mov qword [0x1400a1c20], rax
mov rax, qword [section..data]
cmp qword [rbx + 0x10], rdi
cmovne rax, qword [rbx + 0x10]
mov qword [section..data], rax
mov rax, qword [0x1400a1c28]
cmp qword [rbx + 0x18], rdi
cmovne rax, qword [rbx + 0x18]
mov qword [0x1400a1c28], rax
test cl, cl
je 0x140007649
mov r15, qword [rbx + 0x20]
test r15, r15
jne 0x140007649
mov rax, rdi
xchg qword [0x1400b6860], rax
mov rax, qword [rsp + 0x58]
mov rsi, qword [rax + 8]
jmp 0x140007639
mov r8, qword [rsi + 0x10]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.140012934
mov rbx, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x20]
call fcn.140006700
mov rdx, r12
mov rcx, rbx
call fcn.140050978
cmp byte [rsi + 0x19], dil
je 0x14000760c
mov esi, 0x57
jmp 0x14000887c
movzx ecx, byte [rbx + 0xa]
mov eax, ecx
mov r13d, 2
cmp cl, 1
cmove eax, r13d
mov qword [rsp + 0x80], rdi
mov byte [rsp + 0x88], dil
mov byte [rsp + 0x89], al
mov qword [rsp + 0x40], rdi
mov byte [rsp + 0x48], dil
mov byte [rsp + 0x49], cl
mov qword [rsp + 0x540], rdi
mov byte [rsp + 0x548], dil
mov byte [rsp + 0x549], cl
mov qword [rsp + 0x550], rdi
mov byte [rsp + 0x558], dil
mov byte [rsp + 0x559], cl
mov qword [rsp + 0x560], rdi
mov byte [rsp + 0x568], dil
mov byte [rsp + 0x569], cl
mov qword [rsp + 0x570], rdi
mov byte [rsp + 0x578], dil
mov byte [rsp + 0x579], cl
mov qword [rsp + 0x580], rdi
mov byte [rsp + 0x588], dil
mov byte [rsp + 0x589], cl
mov qword [rsp + 0x5a8], rdi
lea eax, [r13 + 5]
mov qword [rsp + 0x5b0], rax
mov word [rsp + 0x598], di
mov qword [rsp + 0x5c8], rdi
mov qword [rsp + 0x5d0], rax
mov word [rsp + 0x5b8], di
mov qword [rsp + 0x5e8], rdi
mov qword [rsp + 0x5f0], rax
mov word [rsp + 0x5d8], di
mov qword [rsp + 0x590], rdi
mov rax, qword [rbx + 0x28]
mov qword [rsp + 0x20], rax
mov r9, qword [rbx + 0x30]
lea r8, [rsp + 0x540]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x80]
call fcn.140006a80
mov esi, eax
test eax, eax
je 0x14000779b
mov ecx, r13d
call sub.api_ms_win_crt_private_l1_1_0.dll__o___acrt_iob_func
mov rcx, rax
mov r9d, esi
mov r8, qword [0x1400a1c38]
lea rdx, str._ls_:_error_:_Failed_to_Create_OutputFile._Return_code___d_n
call fcn.140051704
jmp 0x1400084f3
lea rcx, [rsp + 0x40]
cmp byte [0x1400a1c35], dil
je 0x140007826
movups xmm0, xmmword [str.________________________________________________________________________n____autogenerated__n___n_______Generated_by_Message_Compiler__mc.exe__n___n_______Copyright__c__Microsoft_Corporation._All_Rights_Reserved._n___n_______Changes_to_this_file_may_cause_incorrect_behavior_and_will_be_lost_if_n_______the_code_is_regenerated._n_____autogenerated__n________________________________________________________________________n]
movdqu xmmword [rsp + 0x510], xmm0
lea rdx, [rsp + 0x510]
call fcn.1400068c4
mov r8, r15
lea rdx, str._nnamespace__ls
lea rcx, [rsp + 0x40]
call fcn.140006878
movups xmm0, xmmword [str._n_n____using_System__n____using_System.Collections.Generic__n____using_System.Text__n____using_System.Diagnostics__n____using_System.Diagnostics.Eventing__n____using_Microsoft.Win32__n____using_System.Runtime.InteropServices__n____using_System.Security.Principal__n]
movdqu xmmword [rsp + 0x520], xmm0
lea rdx, [rsp + 0x520]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
cmp byte [0x1400a1309], dil
jne 0x140008037
movups xmm0, xmmword [str._n____using_System.Threading__n____using_System.Security__n]
movdqu xmmword [rsp + 0x530], xmm0
lea rdx, [rsp + 0x530]
jmp 0x14000802d
movups xmm0, xmmword [str.____n___This_is_an_include_file_generated_by_Message_Compiler._______________n________________________________________________________________________n___Copyright__c__Microsoft_Corporation._All_Rights_Reserved.____________n____npragma_once_n]
movdqu xmmword [rsp + 0x1f0], xmm0
lea rdx, [rsp + 0x1f0]
call fcn.1400068c4
cmp byte [0x1400a1c34], dil
je 0x140008037
lea rax, str._n___n___n___Notes_on_the_ETW_event_code_generated_by_MC:_n___n_____Structures_and_arrays_of_structures_are_treated_as_an_opaque_binary_blob._n_____The_caller_is_responsible_for_packing_the_data_for_the_structure_into_a_n_____single_region_of_memory__with_no_padding_between_values._The_macro_will_n_____have_an_extra_parameter_for_the_length_of_the_blob._n_____Arrays_of_nul_terminated_strings_must_be_packed_by_the_caller_into_a_n_____single_binary_blob_containing_the_correct_number_of_strings__with_a_nul_n_____after_each_string._The_size_of_the_blob_is_specified_in_characters__and_n_____includes_the_final_nul._n_____Arrays_of_SID_are_treated_as_a_single_binary_blob._The_caller_is_n_____responsible_for_packing_the_SID_values_into_a_single_region_of_memory_with_n_____no_padding._n_____The_length_attribute_on_the_data_element_in_the_manifest_is_significant_n_____for_values_with_intype_win:UnicodeString__win:AnsiString__or_win:Binary._n_____The_length_attribute_must_be_specified_for_win:Binary__and_is_optional_for_n_____win:UnicodeString_and_win:AnsiString__if_no_length_is_given__the_strings_n_____are_assumed_to_be_nul_terminated_._For_win:UnicodeString__the_length_is_n_____measured_in_characters__not_bytes._n_____For_an_array_of_win:UnicodeString__win:AnsiString__or_win:Binary__the_n_____length_attribute_applies_to_every_value_in_the_array__so_every_value_in_n_____the_array_must_have_the_same_length._The_values_in_the_array_are_provided_n_____to_the_macro_via_a_single_pointer____the_caller_is_responsible_for_packing_n_____all_of_the_values_into_a_single_region_of_memory_with_no_padding_between_n_____values._n_____Values_of_type_win:CountedUnicodeString__win:CountedAnsiString__and_n_____win:CountedBinary_can_be_generated_and_collected_on_Vista_or_later._n_____However__they_may_not_decode_properly_without_the_Windows_10_2018_Fall_n_____Update._n_____Arrays_of_type_win:CountedUnicodeString__win:CountedAnsiString__and_n_____win:CountedBinary_must_be_packed_by_the_caller_into_a_single_region_of_n_____memory._The_format_for_each_item_is_a_UINT16_byte_count_followed_by_that_n_____many_bytes_of_data._When_providing_the_array_to_the_generated_macro__you_n_____must_provide_the_total_size_of_the_packed_array_data__including_the_UINT16_n_____sizes_for_each_item._In_the_case_of_win:CountedUnicodeString__the_data_n_____size_is_specified_in_WCHAR__16_bit__units._In_the_case_of_n_____win:CountedAnsiString_and_win:CountedBinary__the_data_size_is_specified_in_n_____bytes._n___n___n
lea rcx, str._n___n___Notes_on_the_ETW_event_code_generated_by_MC_with_the__mof_option_enabled:_n___n___General:_The__mof_option_is_deprecated_and_will_be_removed_in_a_future_n____________version_of_MC.exe._n___n___Arrays_:_Only_constant_size_arrays_supported._The_length_must_be_specified_n____________in_the_manifest._n___n___Strings:_No_support_for_arrays_of_strings._n___n___SID____:_No_support_for_array_of_SIDs._The_macro_will_take_a_pointer_to_the_n____________SID_and_use_appropriate_GetLengthSid_function_to_get_the_length._n___n
cmp byte [0x1400a1309], dil
cmove rax, rcx
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x200], xmm0
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
lea rax, str._ninclude__wmistr.h__ninclude__evntrace.h__ninclude__evntprov.h__n_nifndef_ETW_INLINE_n__ifdef__ETW_KM__n_______In_kernel_mode__save_stack_space_by_never_inlining_templates._n____define_ETW_INLINE_DECLSPEC_NOINLINE___inline_n__else_n_______In_user_mode__save_code_size_by_inlining_templates_as_appropriate._n____define_ETW_INLINE___inline_n__endif_nendif____ETW_INLINE_n_nif_defined___cplusplus__nextern__C___nendif_n
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x128], 0x19c
movaps xmm0, xmmword [rsp + 0x120]
movdqa xmmword [rsp + 0x210], xmm0
lea rdx, [rsp + 0x210]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
movups xmm0, xmmword [str._n___n___MCGEN_DISABLE_PROVIDER_CODE_GENERATION_macro:_n___Define_this_macro_to_have_the_compiler_skip_the_generated_functions_in_this_n___header._n___nifndef_MCGEN_DISABLE_PROVIDER_CODE_GENERATION_n]
movdqu xmmword [rsp + 0x220], xmm0
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
cmp byte [0x1400a1309], dil
jne 0x140007cd7
lea rax, str._nif__defined_McGenDebug__ndefine_McGenDebug_a_b____void_0__nendif_n
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x138], 0x43
movaps xmm0, xmmword [rsp + 0x130]
movdqa xmmword [rsp + 0x230], xmm0
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
movups xmm0, xmmword [str._n___n___MCGEN_EVENT_ENABLED_macro:_n___Override_to_control_how_the_EventWrite_EventName__macros_determine_whether_n___an_event_is_enabled._The_default_behavior_is_for_EventWrite_EventName__to_n___use_the_EventEnabled_EventName__macros._n___nifndef_MCGEN_EVENT_ENABLED_ndefine_MCGEN_EVENT_ENABLED_EventName__EventEnabledEventName___nendif_n_n___n___MCGEN_EVENT_ENABLED_FORCONTEXT_macro:_n___Override_to_control_how_the_EventWrite_EventName__ForContext_macros_n___determine_whether_an_event_is_enabled._The_default_behavior_is_for_n___EventWrite_EventName__ForContext_to_use_the_n___EventEnabled_EventName__ForContext_macros._n___nifndef_MCGEN_EVENT_ENABLED_FORCONTEXT_ndefine_MCGEN_EVENT_ENABLED_FORCONTEXT_pContext__EventName__EventEnabledEventName_ForContext_pContext__nendif_n]
movdqu xmmword [rsp + 0x240], xmm0
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
cmp byte [0x1400a1309], dil
jne 0x140007cd7
lea rcx, [rsp + 0x40]
cmp byte [0x1400a1c37], dil
je 0x140007ab7
movups xmm0, xmmword [str._ntypedef_LONG____stdcall_PFN_WMIENTRY_CALLBACK___n_____In__UCHAR_MinorFunction__n_____In_opt__PVOID_DataPath__n_____In__ULONG_BufferLength__n_____Inout_updates_bytes__BufferLength__PVOID_Buffer__n_____In__PVOID_Context__n_____Out__PULONG_Size_n_______n_n___This_function_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._nNTSTATUS___stdcall_nMcGenEventTracingRegister__n_____In__LPCGUID_ProviderId__n_____In_opt__PETWENABLECALLBACK_EnableCallback__n_____In_opt__PVOID_CallbackContext__n_____Inout__PREGHANDLE_RegHandle_n_______n_n___This_function_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._nNTSTATUS___stdcall_nMcGenControlCallback__n_____In__UCHAR_MinorFunction__n_____In_opt__PVOID_DataPath__n_____In__ULONG_BufferLength__n_____Inout_updates_bytes__BufferLength__PVOID_Buffer__n_____In__PVOID_Context__n_____Out__PULONG_Size_n_______n_n___This_function_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._nVOID___stdcall_nMcGenControlCallbackV2__n_____In__LPCGUID_SourceId__n_____In__ULONG_ControlCode__n_____In__UCHAR_Level__n_____In__ULONGLONG_MatchAnyKeyword__n_____In__ULONGLONG_MatchAllKeyword__n_____In_opt__PEVENT_FILTER_DESCRIPTOR_FilterData__n_____Inout_opt__PVOID_CallbackContext_n_______n_ntypedef_nULONG_n___stdcall_PFN_ETW_WRITE___n_____In__REGHANDLE_RegHandle__n_____In__PCEVENT_DESCRIPTOR_EventDescriptor__n_____In_opt__LPCGUID_ActivityId__n_____In__ULONG_UserDataCount__n_____In_reads_opt__UserDataCount__PEVENT_DATA_DESCRIPTOR_UserData_n_______n_ntypedef_nNTSTATUS_n___stdcall_PFN_ETW_REGISTER___n_____In__LPCGUID_ProviderId__n_____In_opt__PETWENABLECALLBACK_EnableCallback__n_____In_opt__PVOID_CallbackContext__n_____Out__PREGHANDLE_RegHandle_n_______n_ntypedef_nNTSTATUS_n___stdcall_PFN_ETW_UNREGISTER___n_____In__REGHANDLE_RegHandle_n_______n_ntypedef_nBOOLEAN_nNTKERNELAPI_n___stdcall_FN_PS_GETVERSION___n_____Out_opt__PULONG_MajorVersion__n_____Out_opt__PULONG_MinorVersion__n_____Out_opt__PULONG_BuildNumber__n_____Out_opt__PUNICODE_STRING_CSDVersion_n_______ntypedef_FN_PS_GETVERSION_PFN_PS_GETVERSION__n_ndefine_WMIREG_FLAG_CALLBACK_0x80000000____not_exposed_in_DDK_n_nifndef_WMIREG_FLAG_TRACE_PROVIDER_ndefine_WMIREG_FLAG_TRACE_PROVIDER_0x00010000_nendif_n_n___This_structure_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._ntypedef_struct__MCGEN_TRACE_CONTEXT_n_npragma_prefast_suppress:__WARNING_ENCODE_GLOBAL_FUNCTION_POINTER___this_pointer_can_not_be_encoded____n____PFN_WMIENTRY_CALLBACK___Callback__n____TRACEHANDLE_____________Logger__n____TRACEHANDLE_____________RegistrationHandle__n____ULONGLONG_______________MatchAnyKeyword__n____ULONGLONG_______________MatchAllKeyword__n____LPCGUID_________________ControlGuid__npragma_prefast_suppress:__WARNING_ENCODE_GLOBAL_FUNCTION_POINTER___this_pointer_can_not_be_encoded____n____PFN_ETW_WRITE___________PfnEtwWrite__npragma_prefast_suppress:__WARNING_ENCODE_GLOBAL_FUNCTION_POINTER___this_pointer_can_not_be_encoded____n____PFN_ETW_REGISTER________PfnEtwRegister__npragma_prefast_suppress:__WARNING_ENCODE_GLOBAL_FUNCTION_POINTER___this_pointer_can_not_be_encoded____n____PFN_ETW_UNREGISTER______PfnEtwUnregister__npragma_prefast_suppress:__WARNING_ENCODE_GLOBAL_FUNCTION_POINTER___this_pointer_can_not_be_encoded____n____PFN_PS_GETVERSION_______pfnPsGetVersion__n____ULONG___________________Flags__n____ULONG___________________IsEnabled__n____UCHAR___________________Level__n____BOOLEAN_________________McGenPreVista__n____BOOLEAN_________________McGenTracingSupportInit__n____USHORT__________________EnableBitsCount__n____PULONG__________________EnableBitMask__n____const_ULONGLONG________EnableKeyWords__n____const_UCHAR____________EnableLevel__n_MCGEN_TRACE_CONTEXT__PMCGEN_TRACE_CONTEXT__n]
movdqu xmmword [rsp + 0x250], xmm0
lea rdx, [rsp + 0x250]
call fcn.1400068c4
movups xmm0, xmmword [str._nBOOLEAN___stdcall_nMcGenEventTracingEnabled__n_____In__PMCGEN_TRACE_CONTEXT_EnableInfo__n_____In__PCEVENT_DESCRIPTOR_EventDescriptor_n_______n_nBOOLEAN___stdcall_nMcGenLevelKeywordEnabled__n_____In__PMCGEN_TRACE_CONTEXT_EnableInfo__n_____In__UCHAR_Level__n_____In__ULONGLONG_Keyword_n_______n_n___This_function_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._nNTSTATUS___stdcall_nMcGenEventTracingUnregister__Inout__PMCGEN_TRACE_CONTEXT_Context___n_n___This_function_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._nNTSTATUS_McGenInitTracingSupport__n_____In__PMCGEN_TRACE_CONTEXT_Context_n_______n_nifdef_ALLOC_PRAGMA_n____pragma_alloc_text__PAGE__McGenEventTracingRegister__n____pragma_alloc_text__PAGE__McGenEventTracingUnregister__n____pragma_alloc_text__PAGE__McGenControlCallback__n____pragma_alloc_text__PAGE__McGenInitTracingSupport__nendif____ALLOC_PRAGMA_n]
movdqu xmmword [rsp + 0x260], xmm0
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
movups xmm0, xmmword [str._n___This_function_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._nFORCEINLINE_nNTSTATUS_McGenInitTracingSupport__n_____In__PMCGEN_TRACE_CONTEXT_Context_n______n__n_nRoutine_Description:_n_n____This_function_assigns_at_runtime_the_ETW_API_set_to_be_use_for_tracing._n_nArguments:_n_n____Context___Provider_Context_n_nRemarks:_n_n____At_runtime_assign_the_functions_pointers_for_the_trace_APIs_to_be_use._n____Vista_and_later_use_EtwWrite__EtwRegister__otherwise_use_IoWMIWriteEvent__IoWMIRegistrationControl_n_n____n_n____ULONG_MajorVersion__0__n____ULONG_MinorVersion__0__n____UNICODE_STRING_Name__n_n____PAGED_CODE____n_n____if__Context__McGenTracingSupportInit___n________return_STATUS_SUCCESS__n_____n_n____RtlInitUnicodeString_Name__L_PsGetVersion____n____Context__pfnPsGetVersion___PFN_PS_GETVERSION___INT_PTR__n________MmGetSystemRoutineAddress_Name___n_n____if__Context__pfnPsGetVersion___NULL___n________Context__pfnPsGetVersion_MajorVersion__n_________________________________MinorVersion__n_________________________________NULL__n_________________________________NULL___n_____n_n____if__MajorVersion___6___n___________n___________If_its_W2K_return_n___________n________if___MajorVersion__5____MinorVersion__0____n____________return_STATUS_INVALID_PARAMETER__n_________n_n___________n___________XP_or_W2K3_n___________n________Context__McGenPreVista__TRUE__n________goto_done__n_____n_n____RtlInitUnicodeString_Name__L_EtwRegister____n____Context__PfnEtwRegister___PFN_ETW_REGISTER___INT_PTR__n________MmGetSystemRoutineAddress_Name___n_n____RtlInitUnicodeString_Name__L_EtwUnregister____n____Context__PfnEtwUnregister___PFN_ETW_UNREGISTER___INT_PTR__n________MmGetSystemRoutineAddress_Name___n_n____RtlInitUnicodeString_Name__L_EtwWrite____n____Context__PfnEtwWrite___PFN_ETW_WRITE___INT_PTR__n________MmGetSystemRoutineAddress_Name___n_n____if___Context__PfnEtwRegister__NULL___n_________Context__PfnEtwUnregister__NULL___n_________Context__PfnEtwWrite__NULL____n___________n___________Subsitute_with_the_generated_funtions_n___________n________Context__PfnEtwRegister__McGenEventTracingRegister__n________Context__PfnEtwUnregister__NULL__n________Context__McGenPreVista__TRUE__n_n________McGenDebug_0____McGenInitTracingSupport__:_Could_not_load_V2_ETW_APIs_n_____n_n_____n_ndone:_n_n____McGenDebug_1_____McGenInitTracingSupport__Prevista__s__n___McGenPreVista____TRUE__:__FALSE______n____Context__McGenTracingSupportInit__TRUE__n____return_STATUS_SUCCESS__n_n]
movdqu xmmword [rsp + 0x270], xmm0
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
lea rax, str._nif__defined_McGenEventRegisterUnregister__ndefine_McGenEventRegisterUnregister
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], 0x50
movaps xmm0, xmmword [rsp + 0x140]
movdqa xmmword [rsp + 0x280], xmm0
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
movups xmm0, xmmword [str._n___This_function_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._nDECLSPEC_NOINLINE___inline_nNTSTATUS___stdcall_nMcGenEventTracingRegister__n_____In__LPCGUID_ProviderId__n_____In_opt__PETWENABLECALLBACK_EnableCallback__n_____In_opt__PVOID_CallbackContext__n_____Inout__PREGHANDLE_RegHandle_n______n__n_nRoutine_Description:_n_n____This_function_registers_the_provider_with_ETW_KERNEL_mode._n_nArguments:_n_n____ProviderId___Provider_ID_to_be_registered_with_ETW._n_n____EnableCallback___Callback_to_be_used._n_n____CallbackContext___Context_for_this_provider._n_n____RegHandle___Pointer_to_registration_handle._n_nRemarks:_n_n____If_the_handle___NULL_will_return_STATUS_SUCCESS_n____If_Windows_2000__provider_will_not_register._n_n____n_n____NTSTATUS_Status__n____PMCGEN_TRACE_CONTEXT_Context___PMCGEN_TRACE_CONTEXT_CallbackContext__n_n____PAGED_CODE____n_n____if___Context___n________return_STATUS_INVALID_PARAMETER__n_____n_n____if___RegHandle___n________return_STATUS_INVALID_PARAMETER__n_____n_n____if__RegHandle___n___________n___________already_registered_n___________n________return_STATUS_SUCCESS__n_____n_n_______n_______Initialize_Tracing_funtion_pointers_according_to_OS_version_n_______n____Status__McGenInitTracingSupport_Context___n____if__Status__STATUS_INVALID_PARAMETER___n___________n___________This_means_that_its_W2K__we_will_not_register_the_provider_n___________n________McGenDebug_0___Generated_code_does_not_support_Windows_2000_n_____n________return_STATUS_SUCCESS__n_____n_n_______n_______Vista_n_______n____if___Context__McGenPreVista___n_n________Status__Context__PfnEtwRegister_ProviderId__n__________________________________________EnableCallback__NULL____McGenControlCallbackV2_:_EnableCallback__n_________________________________________CallbackContext__n_________________________________________RegHandle___n_n_____else__n________Context__Callback___EnableCallback__NULL____McGenControlCallback_:__PFN_WMIENTRY_CALLBACK_EnableCallback__n________Context__ControlGuid__ProviderId__n_npragma_prefast_suppress:__WARNING_BANNED_API_ARGUMENT_USAGE___MC_Generated_Code_Down_Level_Support____n________Status__IoWMIRegistrationControl__PDEVICE_OBJECT_Context__n___________________________________________WMIREG_ACTION_REGISTER___n___________________________________________WMIREG_FLAG_CALLBACK_____n___________________________________________WMIREG_FLAG_TRACE_PROVIDER___n________McGenDebug_0___IoWMIRegistrationControl_Status___08X_n___Status____n________Context__RegistrationHandle___REGHANDLE_Context__n_____n_n____return_Status__n_n]
movdqu xmmword [rsp + 0x290], xmm0
lea rdx, [rsp + 0x290]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
movups xmm0, xmmword [str._n___This_function_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._nDECLSPEC_NOINLINE___inline_nNTSTATUS_n__stdcall_nMcGenEventTracingUnregister__n_____Inout__PMCGEN_TRACE_CONTEXT_Context_n______n__n_nRoutine_Description:_n_n____Unregister_from_ETW_KERNEL_mode._n_n____N.B._If_provider_has_not_registered__RegistrationHandle__NULL__n_________return_STATUS_SUCCESS_n_nArguments:_n_n____Context___Context_for_this_provider_n_nReturn_Value:_n_n____Status_code._n_n____n_n____NTSTATUS_Status__STATUS_SUCCESS__n____PAGED_CODE____n_n____if___Context___n________return_STATUS_INVALID_PARAMETER__n_____n_n____if___Context__McGenTracingSupportInit___n___________n___________EventRegister_ProviderName__macro_has_not_been_called_n___________n________return_STATUS_SUCCESS__n_____n_n____if____Context__RegistrationHandle____n___________n___________Provider_has_not_been_registerd_n___________n________return_STATUS_SUCCESS__n_____n_n____Context__IsEnabled__0__n____if___Context__McGenPreVista___n_n________Status__Context__PfnEtwUnregister_Context__RegistrationHandle___n_n_____else__n_n________IoWMIRegistrationControl__PDEVICE_OBJECT_Context__n_________________________________WMIREG_ACTION_DEREGISTER__n_________________________________WMIREG_FLAG_CALLBACK____n________Context__Flags__0__n________Context__Level__0__n________Context__Logger__0__n________if__Context__EnableBitsCount___0___n____________RtlZeroMemory_Context__EnableBitMask_____Context__EnableBitsCount___1____32___1___sizeof_ULONG____n_________n_____n_n____Context__RegistrationHandle___REGHANDLE_0__n_n____return_Status__n_nendif_n]
movdqu xmmword [rsp + 0x2a0], xmm0
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
movups xmm0, xmmword [str._n___This_function_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._nDECLSPEC_NOINLINE___inline_nVOID_n__stdcall_nMcGenControlCallbackV2__n_____In__LPCGUID_SourceId__n_____In__ULONG_ControlCode__n_____In__UCHAR_Level__n_____In__ULONGLONG_MatchAnyKeyword__n_____In__ULONGLONG_MatchAllKeyword__n_____In_opt__PEVENT_FILTER_DESCRIPTOR_FilterData__n_____Inout_opt__PVOID_CallbackContext_n______n__n_nRoutine_Description:_n_n____This_is_the_notification_callback_for_Windows_Vista_and_later._n_nArguments:_n_n____SourceId___The_GUID_that_identifies_the_session_that_enabled_the_provider._n_n____ControlCode___The_parameter_indicates_whether_the_provider_n__________________is_being_enabled_or_disabled._n_n____Level___The_level_at_which_the_event_is_enabled._n_n____MatchAnyKeyword___The_bitmask_of_keywords_that_the_provider_uses_to_n______________________determine_the_category_of_events_that_it_writes._n_n____MatchAllKeyword___This_bitmask_additionally_restricts_the_category_n______________________of_events_that_the_provider_writes._n_n____FilterData___The_provider_defined_data._n_n____CallbackContext___The_context_of_the_callback_that_is_defined_when_the_provider_n______________________called_EtwRegister_to_register_itself._n_nRemarks:_n_n____ETW_calls_this_function_to_notify_provider_of_enable_disable_n_n____n_n____PMCGEN_TRACE_CONTEXT_Ctx___PMCGEN_TRACE_CONTEXT_CallbackContext__n____ULONG_Ix__nifndef_MCGEN_PRIVATE_ENABLE_CALLBACK_V2_n____UNREFERENCED_PARAMETER_SourceId___n____UNREFERENCED_PARAMETER_FilterData___nendif_n_n____if__Ctx__NULL___n________return__n_____n_n____switch__ControlCode___n_n________case_EVENT_CONTROL_CODE_ENABLE_PROVIDER:_n____________Ctx__Level__Level__n____________Ctx__MatchAnyKeyword__MatchAnyKeyword__n____________Ctx__MatchAllKeyword__MatchAllKeyword__n____________Ctx__IsEnabled__EVENT_CONTROL_CODE_ENABLE_PROVIDER__n_n____________for__Ix__0__Ix___Ctx__EnableBitsCount__Ix__1___n________________if__McGenLevelKeywordEnabled_Ctx__Ctx__EnableLevel_Ix___Ctx__EnableKeyWords_Ix_____FALSE___n____________________Ctx__EnableBitMask_Ix____5____1_____Ix___32____n_________________else__n____________________Ctx__EnableBitMask_Ix____5____1_____Ix___32____n_________________n_____________n____________break__n_n________case_EVENT_CONTROL_CODE_DISABLE_PROVIDER:_n____________Ctx__IsEnabled__EVENT_CONTROL_CODE_DISABLE_PROVIDER__n____________Ctx__Level__0__n____________Ctx__MatchAnyKeyword__0__n____________Ctx__MatchAllKeyword__0__n____________if__Ctx__EnableBitsCount___0___npragma_warning_suppress:_26451_____Arithmetic_overflow_cannot_occur__no_matter_the_value_of_EnableBitCount_n________________RtlZeroMemory_Ctx__EnableBitMask_____Ctx__EnableBitsCount___1____32___1___sizeof_ULONG____n_____________n____________break__n_n________default:_n____________break__n_____n_nifdef_MCGEN_PRIVATE_ENABLE_CALLBACK_V2_n_______n_______Call_user_defined_callback_n_______n____MCGEN_PRIVATE_ENABLE_CALLBACK_V2__n________SourceId__n________ControlCode__n________Level__n________MatchAnyKeyword__n________MatchAllKeyword__n________FilterData__n________CallbackContext_n___________nendif____MCGEN_PRIVATE_ENABLE_CALLBACK_V2_n_n____return__n_n]
movdqu xmmword [rsp + 0x2b0], xmm0
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
movups xmm0, xmmword [str._n___This_function_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._nDECLSPEC_NOINLINE___inline_nNTSTATUS___stdcall_nMcGenControlCallback__n_____In__UCHAR_MinorFunction__n_____In_opt__PVOID_DataPath__n_____In__ULONG_BufferLength__n_____Inout_updates_bytes__BufferLength__PVOID_Buffer__n_____In__PVOID_Context__n_____Out__PULONG_Size_n______n__n_nRoutine_Description:_n_n____Called_by_WMI_for_registration_unregistration_n____or_enabled_disabled._n_nArguments:_n_n____MinorFunction___specifies_the_type_of_callback__register__event_enable_disable__n_n____DataPath___varies_depending_on_the_ActionCode_n_n____BufferLength___size_of_the_Buffer_parameter_n_n____Buffer___in_out_buffer_where_we_read_from_or_write_to_depending_on_the_type_n________of_callback_n_n____Context___the_pointer_private_struct_MCGEN_TRACE_CONTEXT_n_n____Size___output_parameter_to_receive_the_amount_of_data_written_into_Buffer_n_nReturn_Value:_n_n____NTSTATUS_code_indicating_success_failure_n_nComments:_n_n____If_return_value_is_STATUS_BUFFER_TOO_SMALL_and_BufferLength___4__n____then_first_ulong_of_buffer_contains_required_size._n____Supports_XP_and_W2K3__no_W2K_support._n_n____n_n_n____PMCGEN_TRACE_CONTEXT____Ctx__n____NTSTATUS________________Status__STATUS_SUCCESS__n_n____UNREFERENCED_PARAMETER_DataPath___n_n____PAGED_CODE____n_n____McGenDebug_0___McGenControlCallback_0x_08X__p_n___MinorFunction__Context____n_n____Size__0__n_n_______n_______Get_the_context_n_______n____Ctx___PMCGEN_TRACE_CONTEXT_Context__n_n____switch__MinorFunction___n_n________case_IRP_MN_REGINFO:_n_________n____________PWMIREGINFOW_____WmiRegInfo__n____________ULONG____________BufferNeeded__n_n____________WmiRegInfo___PWMIREGINFO_Buffer__n_n_______________n_______________Calculate_buffer_size_need_to_hold_all_info._n_______________n____________BufferNeeded__FIELD_OFFSET_WMIREGINFOW__WmiRegGuid___n___________________________sizeof_WMIREGGUIDW___n_n_______________n_______________If_the_provided_buffer_is_large_enough__then_fill_with_info._n_______________n____________if__BufferNeeded___BufferLength___n_n________________RtlZeroMemory_Buffer__BufferLength___n_n___________________n___________________Fill_in_the_WMIREGINFO_n___________________n________________WmiRegInfo__BufferSize____BufferNeeded__n________________WmiRegInfo__RegistryPath__0__n________________WmiRegInfo__GuidCount_____1__n_n___________________n___________________Fill_in_the_WMIREGGUID_n___________________n________________WmiRegInfo__WmiRegGuid_0_.Guid___Ctx__ControlGuid__n________________WmiRegInfo__WmiRegGuid_0_.Flags__WMIREG_FLAG_TRACE_CONTROL_GUID__n__________________________________________________WMIREG_FLAG_TRACED_GUID__n________________McGenDebug_0___Control_GUID::_08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x_n___n____________________________Ctx__ControlGuid__Data1__n____________________________Ctx__ControlGuid__Data2__n____________________________Ctx__ControlGuid__Data3__n____________________________Ctx__ControlGuid__Data4_0___n____________________________Ctx__ControlGuid__Data4_1___n____________________________Ctx__ControlGuid__Data4_2___n____________________________Ctx__ControlGuid__Data4_3___n____________________________Ctx__ControlGuid__Data4_4___n____________________________Ctx__ControlGuid__Data4_5___n____________________________Ctx__ControlGuid__Data4_6___n____________________________Ctx__ControlGuid__Data4_7__n________________________n_n________________Status__STATUS_SUCCESS__n________________Size___BufferNeeded__n_n_____________else__n________________Status__STATUS_BUFFER_TOO_SMALL__n_n________________if__BufferLength___sizeof_ULONG____n______________________PULONG_Buffer___BufferNeeded__n____________________Size__sizeof_ULONG___n_________________n_____________n_n____________break__n_________n_n________case_IRP_MN_ENABLE_EVENTS:_n________case_IRP_MN_DISABLE_EVENTS:_n_________n____________PWNODE_HEADER_____________Wnode__n____________ULONG_____________________Level__n____________ULONG_____________________ReturnLength__n____________ULONG]
movdqu xmmword [rsp + 0x2c0], xmm0
lea rdx, [rsp + 0x2c0]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
movups xmm0, xmmword [str._nFORCEINLINE_nBOOLEAN_n__stdcall_nMcGenEventTracingEnabled__n_____In__PMCGEN_TRACE_CONTEXT_EnableInfo__n_____In__PCEVENT_DESCRIPTOR_EventDescriptor_n______n_n____return_McGenLevelKeywordEnabled_EnableInfo__EventDescriptor__Level__EventDescriptor__Keyword___n_n_nFORCEINLINE_nBOOLEAN___stdcall_nMcGenLevelKeywordEnabled__n_____In__PMCGEN_TRACE_CONTEXT_EnableInfo__n_____In__UCHAR_Level__n_____In__ULONGLONG_Keyword_n______n_n____if__EnableInfo__n________return_FALSE__n_____n_n____if__EnableInfo__McGenPreVista___n_n__________return_____Level___EnableInfo__Level____Level__0____n______________________ULONG__Keyword__0xFFFFFFFF___0_____ULONG__Keyword__0xFFFFFFFF___EnableInfo__Flags_____n_____n_______n_______Check_if_the_event_Level_is_lower_than_the_level_at_which_n_______the_channel_is_enabled._n_______If_the_event_Level_is_0_or_the_channel_is_enabled_at_level_0__n_______all_levels_are_enabled._n_______n_n____if___Level___EnableInfo__Level______This_also_covers_the_case_of_Level__0._n_________EnableInfo__Level__0____n_n___________n___________Check_if_Keyword_is_enabled_n___________n_n________if___Keyword___ULONGLONG_0___n______________Keyword__EnableInfo__MatchAnyKeyword___n_______________Keyword__EnableInfo__MatchAllKeyword___EnableInfo__MatchAllKeyword_____n____________return_TRUE__n_________n_____n_n____return_FALSE__n_n]
movdqu xmmword [rsp + 0x2d0], xmm0
lea rdx, [rsp + 0x2d0]
jmp 0x140007fa2
movups xmm0, xmmword [str._nif__defined_MCGEN_TRACE_CONTEXT_DEF__ndefine_MCGEN_TRACE_CONTEXT_DEF_n___This_structure_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._ntypedef_struct__MCGEN_TRACE_CONTEXT_n_n____TRACEHANDLE____________RegistrationHandle__n____TRACEHANDLE____________Logger__________Used_as_pointer_to_provider_traits._n____ULONGLONG______________MatchAnyKeyword__n____ULONGLONG______________MatchAllKeyword__n____ULONG__________________Flags__n____ULONG__________________IsEnabled__n____UCHAR__________________Level__n____UCHAR__________________Reserve__n____USHORT_________________EnableBitsCount__n____PULONG_________________EnableBitMask__n____const_ULONGLONG_______EnableKeyWords__n____const_UCHAR___________EnableLevel__n_MCGEN_TRACE_CONTEXT__PMCGEN_TRACE_CONTEXT__nendif____MCGEN_TRACE_CONTEXT_DEF_n]
movdqu xmmword [rsp + 0x2e0], xmm0
lea rdx, [rsp + 0x2e0]
call fcn.1400068c4
movups xmm0, xmmword [str._n___n___n___Vista_down_level_support_n___n___n_ndefine___WARNING_BANNED_LEGACY_INSTRUMENTATION_API_USAGE_28735_n_ntypedef_nULONG_n___stdcall_PFN_EVENT_WRITE___n_____In__REGHANDLE_RegHandle__n_____In__PCEVENT_DESCRIPTOR_EventDescriptor__n_____In__ULONG_UserDataCount__n_____In_reads_opt__UserDataCount__PEVENT_DATA_DESCRIPTOR_UserData_n_______n_ntypedef_nULONG_n___stdcall_PFN_EVENT_REGISTER___n_____In__LPCGUID_ProviderId__n_____In_opt__PENABLECALLBACK_EnableCallback__n_____In_opt__PVOID_CallbackContext__n_____Out__PREGHANDLE_RegHandle_n_______n_ntypedef_nULONG_n___stdcall_PFN_EVENT_UNREGISTER___n_____In__REGHANDLE_RegHandle_n_______n_n___This_function_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._nULONG___stdcall_nMcGenEventTracingRegister__n_____In__LPCGUID_ProviderId__n_____In_opt__PENABLECALLBACK_EnableCallback__n_____In_opt__PVOID_CallbackContext__n_____Inout__PREGHANDLE_RegHandle_n_______n_n___This_function_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._nULONG___stdcall_nMcGenEventTracingUnregister2__n_____Inout__PMCGEN_TRACE_CONTEXT_Context_n_______n_nBOOLEAN___stdcall_nMcGenEventTracingEnabled__n_____In__PMCGEN_TRACE_CONTEXT_EnableInfo__n_____In__PCEVENT_DESCRIPTOR_EventDescriptor_n_______n_nBOOLEAN___stdcall_nMcGenLevelKeywordEnabled__n_____In__PMCGEN_TRACE_CONTEXT_EnableInfo__n_____In__UCHAR_Level__n_____In__ULONGLONG_Keyword_n_______n_nif__defined_MCGEN_TRACE_GLOBALS_DEF__ndefine_MCGEN_TRACE_GLOBALS_DEF_n_n___These_variables_are_for_use_by_MC_generated_code_and_should_not_be_used_directly._n_n__declspec_selectany__BOOLEAN_McGenTracingSupportInit__FALSE__n__declspec_selectany__BOOLEAN_McGenPreVista__FALSE__n_npragma_prefast_suppress:__WARNING_ENCODE_GLOBAL_FUNCTION_POINTER___this_pointer_can_not_be_encoded____n__declspec_selectany__PFN_EVENT_WRITE__PfnEventWrite__NULL__n_npragma_prefast_suppress:__WARNING_ENCODE_GLOBAL_FUNCTION_POINTER___this_pointer_can_not_be_encoded____n__declspec_selectany__PFN_EVENT_REGISTER__PfnEventRegister__McGenEventTracingRegister__n_npragma_prefast_suppress:__WARNING_ENCODE_GLOBAL_FUNCTION_POINTER___this_pointer_can_not_be_encoded____n__declspec_selectany__PFN_EVENT_UNREGISTER_PfnEventUnregister__NULL__n_nendif____MCGEN_TRACE_GLOBALS_DEF_n]
movdqu xmmword [rsp + 0x2f0], xmm0
lea rdx, [rsp + 0x2f0]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
lea rax, str._nif__defined_MCGEN_CONTROL_CALLBACK__ndefine_MCGEN_CONTROL_CALLBACK_n
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], 0x45
movaps xmm0, xmmword [rsp + 0x150]
movdqa xmmword [rsp + 0x300], xmm0
lea rdx, [rsp + 0x300]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
movups xmm0, xmmword [str._n___This_function_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._nDECLSPEC_NOINLINE___inline_nULONG___stdcall_nMcGenControlCallback__n_____In__WMIDPREQUESTCODE_RequestCode__n_____In__PVOID_Context__n_____Inout__ULONG_InOutBufferSize__n_____Inout__PVOID_Buffer_n______n__n_nRoutine_Description:_n_n____This_is_the_notification_callback_for_pre_Vista_support._n_nArguments:_n_nRemarks:_n_n____ETW_calls_this_function_to_notify_provider_of_enable_disable_n_n____n_n____PMCGEN_TRACE_CONTEXT_Ctx___PMCGEN_TRACE_CONTEXT_Context__n____TRACEHANDLE_Logger__n____ULONG_Flags__n____ULONG_IsEnabled__0__n____UCHAR_Level__n____ULONG_Ix__n_n____InOutBufferSize__0__n_n____switch__RequestCode___n_n________case_WMI_ENABLE_EVENTS:_n_____________n________________Logger__GetTraceLoggerHandle__Buffer____n________________Level__GetTraceEnableLevel_Logger___n________________Flags__GetTraceEnableFlags_Logger___n________________IsEnabled__1__n_n________________McGenDebug_1_____Callback__WMI_ENABLE_EVENTS_Ctx__p_Flags__x__n___________________________Lev__d_Logger__I64x_n___n_________________________Ctx__Flags__Level__Logger_____n_n___________________n___________________0_for_flags_is_considered__ALL__n___________________n________________if__Flags__0___n____________________Flags__0xFFFFFFFF__n_________________n_n________________break__n_____________n________case_WMI_DISABLE_EVENTS:_n_____________n________________Logger__0__n________________Flags___0__n________________Level___0__n________________if__Ctx__EnableBitsCount___0___n____________________RtlZeroMemory_Ctx__EnableBitMask_____Ctx__EnableBitsCount___1____32___1___sizeof_ULONG____n_________________n________________McGenDebug_1_____Callback__WMI_DISABLE_EVENTS_Ctx_0x_08p_n___Ctx____n________________break__n_____________n________default:_n_____________n________________return_ERROR_INVALID_PARAMETER___n_____________n_________n_n____Ctx__Logger____Logger__n____Ctx__Level_____Level__n____Ctx__Flags_____Flags__n____Ctx__IsEnabled__IsEnabled__n_n____for__Ix__0__Ix___Ctx__EnableBitsCount__Ix__1___n________if__McGenLevelKeywordEnabled_Ctx__Ctx__EnableLevel_Ix___Ctx__EnableKeyWords_Ix_____FALSE___n____________Ctx__EnableBitMask_Ix____5____1_____Ix___32____n_________else__n____________Ctx__EnableBitMask_Ix____5____1_____Ix___32____n_________n_____n_nifdef_MCGEN_PRIVATE_ENABLE_CALLBACK_n_______n_______Call_user_defined_callback_down_level_n_______n____MCGEN_PRIVATE_ENABLE_CALLBACK__n________RequestCode__n________Context__n________InOutBufferSize__n________Buffer_n___________nendif_n_n____return_ERROR_SUCCESS___n_n]
movdqu xmmword [rsp + 0x310], xmm0
lea rdx, [rsp + 0x310]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
movups xmm0, xmmword [str._n___This_function_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._nDECLSPEC_NOINLINE___inline_nVOID_n__stdcall_nMcGenControlCallbackV2__n_____In__LPCGUID_SourceId__n_____In__ULONG_ControlCode__n_____In__UCHAR_Level__n_____In__ULONGLONG_MatchAnyKeyword__n_____In__ULONGLONG_MatchAllKeyword__n_____In_opt__PEVENT_FILTER_DESCRIPTOR_FilterData__n_____Inout_opt__PVOID_CallbackContext_n______n__n_nRoutine_Description:_n_n____This_is_the_notification_callback_for_Windows_Vista_and_later._n_nArguments:_n_n____SourceId___The_GUID_that_identifies_the_session_that_enabled_the_provider._n_n____ControlCode___The_parameter_indicates_whether_the_provider_n__________________is_being_enabled_or_disabled._n_n____Level___The_level_at_which_the_event_is_enabled._n_n____MatchAnyKeyword___The_bitmask_of_keywords_that_the_provider_uses_to_n______________________determine_the_category_of_events_that_it_writes._n_n____MatchAllKeyword___This_bitmask_additionally_restricts_the_category_n______________________of_events_that_the_provider_writes._n_n____FilterData___The_provider_defined_data._n_n____CallbackContext___The_context_of_the_callback_that_is_defined_when_the_provider_n______________________called_EtwRegister_to_register_itself._n_nRemarks:_n_n____ETW_calls_this_function_to_notify_provider_of_enable_disable_n_n____n_n____PMCGEN_TRACE_CONTEXT_Ctx___PMCGEN_TRACE_CONTEXT_CallbackContext__n____ULONG_Ix__nifndef_MCGEN_PRIVATE_ENABLE_CALLBACK_V2_n____UNREFERENCED_PARAMETER_SourceId___n____UNREFERENCED_PARAMETER_FilterData___nendif_n_n____if__Ctx__NULL___n________return__n_____n_n____switch__ControlCode___n_n________case_EVENT_CONTROL_CODE_ENABLE_PROVIDER:_n____________Ctx__Level__Level__n____________Ctx__MatchAnyKeyword__MatchAnyKeyword__n____________Ctx__MatchAllKeyword__MatchAllKeyword__n____________Ctx__IsEnabled__EVENT_CONTROL_CODE_ENABLE_PROVIDER__n_n____________for__Ix__0__Ix___Ctx__EnableBitsCount__Ix__1___n________________if__McGenLevelKeywordEnabled_Ctx__Ctx__EnableLevel_Ix___Ctx__EnableKeyWords_Ix_____FALSE___n____________________Ctx__EnableBitMask_Ix____5____1_____Ix___32____n_________________else__n____________________Ctx__EnableBitMask_Ix____5____1_____Ix___32____n_________________n_____________n____________break__n_n________case_EVENT_CONTROL_CODE_DISABLE_PROVIDER:_n____________Ctx__IsEnabled__EVENT_CONTROL_CODE_DISABLE_PROVIDER__n____________Ctx__Level__0__n____________Ctx__MatchAnyKeyword__0__n____________Ctx__MatchAllKeyword__0__n____________if__Ctx__EnableBitsCount___0___npragma_warning_suppress:_26451_____Arithmetic_overflow_cannot_occur__no_matter_the_value_of_EnableBitCount_n________________RtlZeroMemory_Ctx__EnableBitMask_____Ctx__EnableBitsCount___1____32___1___sizeof_ULONG____n_____________n____________break__n_n________default:_n____________break__n_____n_nifdef_MCGEN_PRIVATE_ENABLE_CALLBACK_V2_n_______n_______Call_user_defined_callback_n_______n____MCGEN_PRIVATE_ENABLE_CALLBACK_V2__n________SourceId__n________ControlCode__n________Level__n________MatchAnyKeyword__n________MatchAllKeyword__n________FilterData__n________CallbackContext_n___________nendif____MCGEN_PRIVATE_ENABLE_CALLBACK_V2_n_n____return__n_n]
movdqu xmmword [rsp + 0x320], xmm0
lea rdx, [rsp + 0x320]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
lea rax, str._nendif____MCGEN_CONTROL_CALLBACK_n
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], 0x22
movaps xmm0, xmmword [rsp + 0x160]
movdqa xmmword [rsp + 0x330], xmm0
lea rdx, [rsp + 0x330]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
lea rax, str._ndefine_MANIFEST_MAX_MOF_FIELDS_SUPPORTED_16_n_nVOID_McGenInitTracingSupport__n____VOID_n_______nif__defined_McGenEventRegisterUnregister__ndefine_McGenEventRegisterUnregister_npragma_warning_push__npragma_warning_disable:4068_
mov qword [rsp + 0x170], rax
mov qword [rsp + 0x178], 0xe0
movaps xmm0, xmmword [rsp + 0x170]
movdqa xmmword [rsp + 0x340], xmm0
lea rdx, [rsp + 0x340]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
movups xmm0, xmmword [str._n___This_function_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._nFORCEINLINE_nULONG___stdcall_nMcGenEventTracingRegister__n_____In__LPCGUID_ProviderId__n_____In_opt__PENABLECALLBACK_EnableCallback__n_____In_opt__PVOID_CallbackContext__n_____Inout__PREGHANDLE_RegHandle_n______n__n_nRoutine_Description:_n_n____This_function_registers_the_provider_with_ETW_and_handles_OS_version._n_nArguments:_n____ProviderId________Provider_Id_to_be_register_with_ETW_n____EnableCallback____Callback_to_be_used:_n______________________Vista_:_McGenControlCallbackV2_n______________________down_level_:_McGenControlCallback_n____CallbackContext___Context_for_this_provider_is_PMCGEN_TRACE_CONTEXT_n____RegHandle_________down_level_is_a_pointer_to_PMCGEN_TRACE_CONTEXT_n_nRemarks:_n_n____Register_with_ETW_Vista_down_level__and_set_the_RegHandle_as_a_pointer_to_n____PMCGEN_TRACE_CONTEXT_for_this_provider._For_Vista_registers_the_provider._n_n____n_n____ULONG_Error__ERROR_SUCCESS__n_n____if__RegHandle___n________return_ERROR_INVALID_PARAMETER__n_____n_n____if_RegHandle___n___________n___________already_registered__ignore_this_one_n___________n________goto_Cleanup__n_____n_n_______n_______Initialize_Tracing_funtion_pointers_according_to_OS_version_n_______n____McGenInitTracingSupport____n_n_______n_______Vista_n_______n____if__McGenPreVista___n________Error__PfnEventRegister_ProviderId__n__________________________________EnableCallback__NULL____McGenControlCallbackV2_:_EnableCallback__n_________________________________CallbackContext__n_________________________________RegHandle___n_____else__n___________n___________down_level_:_XP_W2K3_n___________n________PMCGEN_TRACE_CONTEXT_Context___PMCGEN_TRACE_CONTEXT_CallbackContext__n________TRACE_GUID_REGISTRATION_TraceRegistration__n_n________if_CallbackContext__NULL___n____________Error___ERROR_INVALID_PARAMETER__n____________goto_Cleanup__n_________n_n________RegHandle___REGHANDLE_CallbackContext__n_n________TraceRegistration.Guid__ProviderId__n________TraceRegistration.RegHandle__0__n_npragma_prefast_suppress:__WARNING_BANNED_LEGACY_INSTRUMENTATION_API_USAGE___Generated_Code_Down_Level_Support____n________Error__RegisterTraceGuids__EnableCallback__NULL____McGenControlCallback_:__WMIDPREQUEST_EnableCallback__n____________________________________CallbackContext__n____________________________________ProviderId__n____________________________________1__n____________________________________TraceRegistration__n____________________________________0__n____________________________________0__n____________________________________Context__RegistrationHandle___n_____n_nCleanup:_n____return_Error__n_n]
movdqu xmmword [rsp + 0x350], xmm0
lea rdx, [rsp + 0x350]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
movups xmm0, xmmword [str._n___This_function_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._nFORCEINLINE_nULONG___stdcall_nMcGenEventTracingUnregister__In__PREGHANDLE_RegHandle__n__n_nRoutine_Description:_n_n____Unregister_from_ETW._n_nArguments:_n____________RegHandle_is_the_pointer_to_the_provider_context_down_level_nRemarks:_n_n____Unregister_provider_and_disables_provider_context_n_n____n_n____ULONG_Error__ERROR_SUCCESS__n_n____if__RegHandle___n________return_ERROR_INVALID_PARAMETER__n_____n_n____if___McGenTracingSupportInit__n___________n___________EventRegister_ProviderName__macro_has_not_been_called_n___________n________return_ERROR_SUCCESS__n_____n_n____if___RegHandle____n___________n___________Provider_has_not_registerd_n___________n________return_ERROR_SUCCESS__n_____n_n_______n_______Vista_n_______n____if__McGenPreVista___n________Error__PfnEventUnregister_RegHandle___n_____else__n___________n___________down_level_:_XP_W2K3_n___________n________PMCGEN_TRACE_CONTEXT_Context___PMCGEN_TRACE_CONTEXT__ULONG_PTR__RegHandle___n_npragma_prefast_suppress:__WARNING_BANNED_LEGACY_INSTRUMENTATION_API_USAGE___Generated_Code_Down_Level_Support____n________Error__UnregisterTraceGuids_Context__RegistrationHandle___n_n________Context__Flags__0__n________Context__Level__0__n________Context__Logger__0__n________if__Context__EnableBitsCount___0___n____________RtlZeroMemory_Context__EnableBitMask_____Context__EnableBitsCount___1____32___1___sizeof_ULONG____n_________n________Context__RegistrationHandle__0__n_____n_n____RegHandle___REGHANDLE_0__n_n____return_Error__n_n]
movdqu xmmword [rsp + 0x360], xmm0
lea rdx, [rsp + 0x360]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
lea rax, str._npragma_warning_pop__nendif____McGenEventRegisterUnregister_n
mov qword [rsp + 0x180], rax
mov qword [rsp + 0x188], 0x3d
movaps xmm0, xmmword [rsp + 0x180]
movdqa xmmword [rsp + 0x370], xmm0
lea rdx, [rsp + 0x370]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
movups xmm0, xmmword [str._nif__defined_McGenEventTracingUnregister2_df__ndefine_McGenEventTracingUnregister2_df_npragma_warning_push__npragma_warning_disable:4068__n___This_function_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._n__inline_nULONG___stdcall_nMcGenEventTracingUnregister2__n_____Inout__PMCGEN_TRACE_CONTEXT_Context_n______n__n_nRoutine_Description:_n_n____Unregister_from_ETW._n_nArguments:_n_n____Context_is_the_pointer_to_the_provider_context._n_n____n_n____ULONG_Error__n_n____if__Context__NULL___n________return_ERROR_INVALID_PARAMETER__n_____n_n____if___McGenTracingSupportInit___n___________n___________EventRegister_ProviderName__macro_has_not_been_called_n___________n________return_ERROR_SUCCESS__n_____n_n____if___Context__RegistrationHandle___n___________n___________Provider_has_not_registered_n___________n________return_ERROR_SUCCESS__n_____n_n_______n_______Vista_n_______n____if___McGenPreVista___n________Error__PfnEventUnregister_Context__RegistrationHandle___n_____else__n___________n___________down_level_:_XP_W2K3_n___________n_npragma_prefast_suppress:__WARNING_BANNED_LEGACY_INSTRUMENTATION_API_USAGE___Generated_Code_Down_Level_Support____n________Error__UnregisterTraceGuids_Context__RegistrationHandle___n_n________Context__Flags__0__n________Context__Level__0__n________Context__Logger__0__n________if__Context__EnableBitsCount___0___n____________RtlZeroMemory_Context__EnableBitMask_____Context__EnableBitsCount___1____32___1___sizeof_ULONG____n_________n_____n_n____Context__RegistrationHandle__0__n____return_Error__n_npragma_warning_pop__nendif____McGenEventTracingUnregister2_df_n]
movdqu xmmword [rsp + 0x380], xmm0
lea rdx, [rsp + 0x380]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
movups xmm0, xmmword [str._nif__defined_McGenEventEnabledCheck__ndefine_McGenEventEnabledCheck_nFORCEINLINE_nBOOLEAN___stdcall_nMcGenLevelKeywordEnabled__n_____In__PMCGEN_TRACE_CONTEXT_EnableInfo__n_____In__UCHAR_Level__n_____In__ULONGLONG_Keyword_n______n_n____if__EnableInfo__n________return_FALSE__n_____n_n____if_McGenPreVista__n_n______return_____Level___EnableInfo__Level____EnableInfo__Level__0____n__________________ULONG__Keyword__0xFFFFFFFF___0_____ULONG__Keyword__0xFFFFFFFF___EnableInfo__Flags_____n_____n_______n_______Check_if_the_event_level_is_lower_than_the_level_at_which_n_______the_channel_is_enabled._n_______If_the_event_level_is_0_or_the_channel_is_enabled_at_level_0__n_______all_levels_are_enabled._n_______n_n____if___Level___EnableInfo__Level______This_also_covers_the_case_of_Level__0._n_________EnableInfo__Level__0____n_n___________n___________Check_if_Keyword_is_enabled_n___________n_n________if___Keyword___ULONGLONG_0___n______________Keyword__EnableInfo__MatchAnyKeyword___n_______________Keyword__EnableInfo__MatchAllKeyword___EnableInfo__MatchAllKeyword_____n____________return_TRUE__n_________n_____n_n____return_FALSE__n_n_nFORCEINLINE_nBOOLEAN___stdcall_nMcGenEventTracingEnabled__n_____In__PMCGEN_TRACE_CONTEXT_EnableInfo__n_____In__PCEVENT_DESCRIPTOR_EventDescriptor_n______n_n_n____return_McGenLevelKeywordEnabled_EnableInfo__EventDescriptor__Level__EventDescriptor__Keyword___n_nendif_n]
movdqu xmmword [rsp + 0x390], xmm0
lea rdx, [rsp + 0x390]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
movups xmm0, xmmword [str._nif__defined_MCGEN_TRACING_DLL__ndefine_MCGEN_TRACING_DLL_L_advapi32.dll__nendif_nif__defined_MCGEN_TRACING_DLL_V2__ndefine_MCGEN_TRACING_DLL_V2_L_api_ms_win_eventing_provider_l1_1_0.dll__nendif_nif__defined_MCGEN_EVENTWRITE_API__ndefine_MCGEN_EVENTWRITE_API___EventWrite__nendif_nif__defined_MCGEN_EVENTREGISTER_API__ndefine_MCGEN_EVENTREGISTER_API____EventRegister__nendif_nif__defined_MCGEN_EVENTUNREGISTER_API__ndefine_MCGEN_EVENTUNREGISTER_API__EventUnregister__nendif_n_nif__defined_McGenInitTracingSupportFunc__ndefine_McGenInitTracingSupportFunc_n___This_function_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._nFORCEINLINE_nVOID_McGenInitTracingSupport__n____VOID_n______n__n_nRoutine_Description:_n_n____This_function_assigns_at_runtime_the_ETW_API_set_to_be_use_for_tracing._n_nArguments:_n_nRemarks:_n_n____At_runtime_assign_the_function_pointers_for_the_trace_APIs_to_be_used._n____Vista_and_later_uses_WriteEvent__otherwise_use_TraceEvent._n_n____n_n____OSVERSIONINFO_OSVersion__n____HINSTANCE_TraceApiDll__NULL__n____BOOL_OkVersion__n____BOOL_IsWin8OrLater__FALSE__n_n____if__McGenTracingSupportInit__n________return__n_____n_n____OSVersion.dwOSVersionInfoSize__sizeof_OSVERSIONINFO___n_n____OkVersion__GetVersionEx_OSVersion___n_n____if__OkVersion___n_n________McGenPreVista___OSVersion.dwMajorVersion___6___n________IsWin8OrLater___OSVersion.dwMajorVersion___6_____OSVersion.dwMajorVersion__6____OSVersion.dwMinorVersion___1____n_n________if__McGenPreVista___n_n____________goto_done__n_n_________n_n_____n_n____TraceApiDll__GetModuleHandleW_MCGEN_TRACING_DLL___n____if___TraceApiDll__NULL____IsWin8OrLater___FALSE____n________TraceApiDll__GetModuleHandleW_MCGEN_TRACING_DLL_V2___n_____n_n____if__TraceApiDll___NULL__n_____n________PfnEventWrite___PFN_EVENT_WRITE_GetProcAddress_TraceApiDll__MCGEN_EVENTWRITE_API___n_n________if__NULL__PfnEventWrite___n_n____________if__OkVersion___n________________McGenDebug_1_____McGenInitTracing__Failed_to_load_EventWrite__using_PreVista_ETW__n_____n_____________n_n____________McGenPreVista__TRUE__n____________goto_done__n_n_________n_n________PfnEventRegister___PFN_EVENT_REGISTER__GetProcAddress_TraceApiDll__MCGEN_EVENTREGISTER_API___n_n________if__NULL__PfnEventRegister___n____________McGenDebug_1_____McGenInitTracing__Failed_to_load_EventRegister__using_PreVista_ETW__n_____n____________PfnEventRegister___McGenEventTracingRegister__n____________McGenPreVista__TRUE__n____________goto_done__n_n_________n_n________PfnEventUnregister___PFN_EVENT_UNREGISTER__GetProcAddress_TraceApiDll__MCGEN_EVENTUNREGISTER_API___n_n________if__NULL__PfnEventUnregister___n____________McGenDebug_1_____McGenInitTracing__Failed_to_load_EventUnregister__using_PreVista_ETW__n_____n____________PfnEventRegister__McGenEventTracingRegister__n____________McGenPreVista__TRUE__n____________goto_done__n________n_n_____else__n_n________McGenDebug_1_____McGenInitTracing__Failed_to_load__ls__using_PreVista_ETW__n___MCGEN_TRACING_DLL____n________McGenPreVista__TRUE__n_n_____n_ndone:_n_n____McGenDebug_1_____McGenInitTracing__Prevista__s__n___McGenPreVista____TRUE__:__FALSE______n____McGenTracingSupportInit__TRUE__n_nendif_n]
movdqu xmmword [rsp + 0x3a0], xmm0
lea rdx, [rsp + 0x3a0]
jmp 0x140007fa2
movups xmm0, xmmword [str._n___n___MCGEN_USE_KERNEL_MODE_APIS_macro:_n___Controls_whether_the_generated_code_uses_kernel_mode_or_user_mode_APIs._n_____Set_to_0_to_use_Windows_user_mode_APIs_such_as_EventRegister._n_____Set_to_1_to_use_Windows_kernel_mode_APIs_such_as_EtwRegister._n___Default_is_based_on_whether_the__ETW_KM__macro_is_defined__i.e._by_wdm.h_._n___Note_that_the_APIs_can_also_be_overridden_directly__e.g._by_setting_the_n___MCGEN_EVENTWRITETRANSFER_or_MCGEN_EVENTREGISTER_macros._n___nifndef_MCGEN_USE_KERNEL_MODE_APIS_n__ifdef__ETW_KM__n____define_MCGEN_USE_KERNEL_MODE_APIS_1_n__else_n____define_MCGEN_USE_KERNEL_MODE_APIS_0_n__endif_nendif____MCGEN_USE_KERNEL_MODE_APIS_n_n___n___MCGEN_HAVE_EVENTSETINFORMATION_macro:_n___Controls_how_McGenEventSetInformation_uses_the_EventSetInformation_API._n_____Set_to_0_to_disable_the_use_of_EventSetInformation_n______McGenEventSetInformation_will_always_return_an_error_._n_____Set_to_1_to_directly_invoke_MCGEN_EVENTSETINFORMATION._n_____Set_to_2_to_to_locate_EventSetInformation_at_runtime_via_GetProcAddress_n______user_mode__or_MmGetSystemRoutineAddress__kernel_mode_._n___Default_is_determined_as_follows:_n_____If_MCGEN_EVENTSETINFORMATION_has_been_customized__set_to_1_n______i.e._use_MCGEN_EVENTSETINFORMATION_._n_____Else_if_the_target_OS_version_has_EventSetInformation__set_to_1_n______i.e._use_MCGEN_EVENTSETINFORMATION_._n_____Else_set_to_2__i.e._try_to_dynamically_locate_EventSetInformation_._n___Note_that_an_McGenEventSetInformation_function_will_only_be_generated_if_one_n___or_more_provider_in_a_manifest_has_provider_traits._n___nifndef_MCGEN_HAVE_EVENTSETINFORMATION_n__ifdef_MCGEN_EVENTSETINFORMATION________________if_MCGEN_EVENTSETINFORMATION_has_been_customized__n____define_MCGEN_HAVE_EVENTSETINFORMATION___1______directly_invoke_MCGEN_EVENTSETINFORMATION_..._._n__elif_MCGEN_USE_KERNEL_MODE_APIS________________else_if_using_kernel_mode_APIs__n____if_NTDDI_VERSION___0x06040000_________________if_target_OS_is_Windows_10_or_later__n______define_MCGEN_HAVE_EVENTSETINFORMATION_1________directly_invoke_MCGEN_EVENTSETINFORMATION_..._._n____else___________________________________________else_n______define_MCGEN_HAVE_EVENTSETINFORMATION_2________find__EtwSetInformation__via_MmGetSystemRoutineAddress._n____endif________________________________________else__using_user_mode_APIs__n__else_____________________________________________if_target_OS_and_SDK_is_Windows_8_or_later__n____if_WINVER___0x0602__defined_EVENT_FILTER_TYPE_SCHEMATIZED__n______define_MCGEN_HAVE_EVENTSETINFORMATION_1________directly_invoke_MCGEN_EVENTSETINFORMATION_..._._n____else___________________________________________else_n______define_MCGEN_HAVE_EVENTSETINFORMATION_2________find__EventSetInformation__via_GetModuleHandleExW_GetProcAddress._n____endif_n__endif_nendif____MCGEN_HAVE_EVENTSETINFORMATION_n_n___n___MCGEN_Override_Macros_n___n___The_following_override_macros_may_be_defined_before_including_this_header_n___to_control_the_APIs_used_by_this_header:_n___n_____MCGEN_EVENTREGISTER_n_____MCGEN_EVENTUNREGISTER_n_____MCGEN_EVENTSETINFORMATION_n_____MCGEN_EVENTWRITETRANSFER_n___n___If_the_the_macro_is_undefined__the_MC_implementation_will_default_to_the_n___corresponding_ETW_APIs._For_example__if_the_MCGEN_EVENTREGISTER_macro_is_n___undefined__the_EventRegister_MyProviderName__macro_will_use_EventRegister_n___in_user_mode_and_will_use_EtwRegister_in_kernel_mode._n___n___To_prevent_issues_from_conflicting_definitions_of_these_macros__the_value_n___of_the_override_macro_will_be_used_as_a_suffix_in_certain_internal_function_n___names._Because_of_this__the_override_macros_must_follow_certain_rules:_n___n_____The_macro_must_be_defined_before_any_MC_generated_header_is_included_and_n_____must_not_be_undefined_or_redefined_after_any_MC_generated_header_is_n_____included._Different_translation_units__i.e._different_.c_or_.cpp_files__n_____may_set_the_macros_to_different_values__but_within_a_translation_unit_n______within_a_single_.c_or_.cpp_file___the_macro_must_be_set_once_and_not_n_____changed._n_____The_overri]
movdqu xmmword [rsp + 0x3b0], xmm0
lea rdx, [rsp + 0x3b0]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
movups xmm0, xmmword [str._n___n___MCGEN_EVENT_ENABLED_macro:_n___Override_to_control_how_the_EventWrite_EventName__macros_determine_whether_n___an_event_is_enabled._The_default_behavior_is_for_EventWrite_EventName__to_n___use_the_EventEnabled_EventName__macros._n___nifndef_MCGEN_EVENT_ENABLED_ndefine_MCGEN_EVENT_ENABLED_EventName__EventEnabledEventName___nendif_n_n___n___MCGEN_EVENT_ENABLED_FORCONTEXT_macro:_n___Override_to_control_how_the_EventWrite_EventName__ForContext_macros_n___determine_whether_an_event_is_enabled._The_default_behavior_is_for_n___EventWrite_EventName__ForContext_to_use_the_n___EventEnabled_EventName__ForContext_macros._n___nifndef_MCGEN_EVENT_ENABLED_FORCONTEXT_ndefine_MCGEN_EVENT_ENABLED_FORCONTEXT_pContext__EventName__EventEnabledEventName_ForContext_pContext__nendif_n]
movdqu xmmword [rsp + 0x3c0], xmm0
lea rdx, [rsp + 0x3c0]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
lea rax, str._n___n___MCGEN_ENABLE_CHECK_macro:_n___Determines_whether_the_specified_event_would_be_considered_as_enabled_n___based_on_the_state_of_the_specified_context._Slightly_faster_than_calling_n___McGenEventEnabled_directly._n___nifndef_MCGEN_ENABLE_CHECK_ndefine_MCGEN_ENABLE_CHECK_Context__Descriptor___Context.IsEnabled__McGenEventEnabled_Context__Descriptor___nendif_n
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x198], 0x16b
movaps xmm0, xmmword [rsp + 0x190]
movdqa xmmword [rsp + 0x3d0], xmm0
lea rdx, [rsp + 0x3d0]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
movups xmm0, xmmword [str._nif__defined_MCGEN_TRACE_CONTEXT_DEF__ndefine_MCGEN_TRACE_CONTEXT_DEF_n___This_structure_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._ntypedef_struct__MCGEN_TRACE_CONTEXT_n_n____TRACEHANDLE____________RegistrationHandle__n____TRACEHANDLE____________Logger__________Used_as_pointer_to_provider_traits._n____ULONGLONG______________MatchAnyKeyword__n____ULONGLONG______________MatchAllKeyword__n____ULONG__________________Flags__n____ULONG__________________IsEnabled__n____UCHAR__________________Level__n____UCHAR__________________Reserve__n____USHORT_________________EnableBitsCount__n____PULONG_________________EnableBitMask__n____const_ULONGLONG_______EnableKeyWords__n____const_UCHAR___________EnableLevel__n_MCGEN_TRACE_CONTEXT__PMCGEN_TRACE_CONTEXT__nendif____MCGEN_TRACE_CONTEXT_DEF_n]
movdqu xmmword [rsp + 0x3e0], xmm0
lea rdx, [rsp + 0x3e0]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
movups xmm0, xmmword [str._nif__defined_MCGEN_LEVEL_KEYWORD_ENABLED_DEF__ndefine_MCGEN_LEVEL_KEYWORD_ENABLED_DEF_n___n___Determines_whether_an_event_with_a_given_Level_and_Keyword_would_be_n___considered_as_enabled_based_on_the_state_of_the_specified_context._n___Note_that_you_may_want_to_use_MCGEN_ENABLE_CHECK_instead_of_calling_this_n___function_directly._n___nFORCEINLINE_nBOOLEAN_nMcGenLevelKeywordEnabled__n_____In__PMCGEN_TRACE_CONTEXT_EnableInfo__n_____In__UCHAR_Level__n_____In__ULONGLONG_Keyword_n______n_n_______n_______Check_if_the_event_Level_is_lower_than_the_level_at_which_n_______the_channel_is_enabled._n_______If_the_event_Level_is_0_or_the_channel_is_enabled_at_level_0__n_______all_levels_are_enabled._n_______n_n____if___Level___EnableInfo__Level______This_also_covers_the_case_of_Level__0._n_________EnableInfo__Level__0____n_n___________n___________Check_if_Keyword_is_enabled_n___________n_n________if___Keyword___ULONGLONG_0___n______________Keyword__EnableInfo__MatchAnyKeyword___n_______________Keyword__EnableInfo__MatchAllKeyword___EnableInfo__MatchAllKeyword_____n____________return_TRUE__n_________n_____n_n____return_FALSE__n_nendif____MCGEN_LEVEL_KEYWORD_ENABLED_DEF_n]
movdqu xmmword [rsp + 0x3f0], xmm0
lea rdx, [rsp + 0x3f0]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
movups xmm0, xmmword [str._nif__defined_MCGEN_EVENT_ENABLED_DEF__ndefine_MCGEN_EVENT_ENABLED_DEF_n___n___Determines_whether_the_specified_event_would_be_considered_as_enabled_based_n___on_the_state_of_the_specified_context._Note_that_you_may_want_to_use_n___MCGEN_ENABLE_CHECK_instead_of_calling_this_function_directly._n___nFORCEINLINE_nBOOLEAN_nMcGenEventEnabled__n_____In__PMCGEN_TRACE_CONTEXT_EnableInfo__n_____In__PCEVENT_DESCRIPTOR_EventDescriptor_n______n_n____return_McGenLevelKeywordEnabled_EnableInfo__EventDescriptor__Level__EventDescriptor__Keyword___n_nendif____MCGEN_EVENT_ENABLED_DEF_n]
movdqu xmmword [rsp + 0x400], xmm0
lea rdx, [rsp + 0x400]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
lea rax, str._nif__defined_MCGEN_CONTROL_CALLBACK__ndefine_MCGEN_CONTROL_CALLBACK_n
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], 0x45
movaps xmm0, xmmword [rsp + 0x1a0]
movdqa xmmword [rsp + 0x410], xmm0
lea rdx, [rsp + 0x410]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
movups xmm0, xmmword [str._n___This_function_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._nDECLSPEC_NOINLINE___inline_nVOID_n__stdcall_nMcGenControlCallbackV2__n_____In__LPCGUID_SourceId__n_____In__ULONG_ControlCode__n_____In__UCHAR_Level__n_____In__ULONGLONG_MatchAnyKeyword__n_____In__ULONGLONG_MatchAllKeyword__n_____In_opt__PEVENT_FILTER_DESCRIPTOR_FilterData__n_____Inout_opt__PVOID_CallbackContext_n______n__n_nRoutine_Description:_n_n____This_is_the_notification_callback_for_Windows_Vista_and_later._n_nArguments:_n_n____SourceId___The_GUID_that_identifies_the_session_that_enabled_the_provider._n_n____ControlCode___The_parameter_indicates_whether_the_provider_n__________________is_being_enabled_or_disabled._n_n____Level___The_level_at_which_the_event_is_enabled._n_n____MatchAnyKeyword___The_bitmask_of_keywords_that_the_provider_uses_to_n______________________determine_the_category_of_events_that_it_writes._n_n____MatchAllKeyword___This_bitmask_additionally_restricts_the_category_n______________________of_events_that_the_provider_writes._n_n____FilterData___The_provider_defined_data._n_n____CallbackContext___The_context_of_the_callback_that_is_defined_when_the_provider_n______________________called_EtwRegister_to_register_itself._n_nRemarks:_n_n____ETW_calls_this_function_to_notify_provider_of_enable_disable_n_n____n_n____PMCGEN_TRACE_CONTEXT_Ctx___PMCGEN_TRACE_CONTEXT_CallbackContext__n____ULONG_Ix__nifndef_MCGEN_PRIVATE_ENABLE_CALLBACK_V2_n____UNREFERENCED_PARAMETER_SourceId___n____UNREFERENCED_PARAMETER_FilterData___nendif_n_n____if__Ctx__NULL___n________return__n_____n_n____switch__ControlCode___n_n________case_EVENT_CONTROL_CODE_ENABLE_PROVIDER:_n____________Ctx__Level__Level__n____________Ctx__MatchAnyKeyword__MatchAnyKeyword__n____________Ctx__MatchAllKeyword__MatchAllKeyword__n____________Ctx__IsEnabled__EVENT_CONTROL_CODE_ENABLE_PROVIDER__n_n____________for__Ix__0__Ix___Ctx__EnableBitsCount__Ix__1___n________________if__McGenLevelKeywordEnabled_Ctx__Ctx__EnableLevel_Ix___Ctx__EnableKeyWords_Ix_____FALSE___n____________________Ctx__EnableBitMask_Ix____5____1_____Ix___32____n_________________else__n____________________Ctx__EnableBitMask_Ix____5____1_____Ix___32____n_________________n_____________n____________break__n_n________case_EVENT_CONTROL_CODE_DISABLE_PROVIDER:_n____________Ctx__IsEnabled__EVENT_CONTROL_CODE_DISABLE_PROVIDER__n____________Ctx__Level__0__n____________Ctx__MatchAnyKeyword__0__n____________Ctx__MatchAllKeyword__0__n____________if__Ctx__EnableBitsCount___0___npragma_warning_suppress:_26451_____Arithmetic_overflow_cannot_occur__no_matter_the_value_of_EnableBitCount_n________________RtlZeroMemory_Ctx__EnableBitMask_____Ctx__EnableBitsCount___1____32___1___sizeof_ULONG____n_____________n____________break__n_n________default:_n____________break__n_____n_nifdef_MCGEN_PRIVATE_ENABLE_CALLBACK_V2_n_______n_______Call_user_defined_callback_n_______n____MCGEN_PRIVATE_ENABLE_CALLBACK_V2__n________SourceId__n________ControlCode__n________Level__n________MatchAnyKeyword__n________MatchAllKeyword__n________FilterData__n________CallbackContext_n___________nendif____MCGEN_PRIVATE_ENABLE_CALLBACK_V2_n_n____return__n_n]
movdqu xmmword [rsp + 0x420], xmm0
lea rdx, [rsp + 0x420]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
lea rax, str._nendif____MCGEN_CONTROL_CALLBACK_n
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1b8], 0x22
movaps xmm0, xmmword [rsp + 0x1b0]
movdqa xmmword [rsp + 0x430], xmm0
lea rdx, [rsp + 0x430]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
movups xmm0, xmmword [str._nifndef__mcgen_PENABLECALLBACK_n__if_MCGEN_USE_KERNEL_MODE_APIS_n____define__mcgen_PENABLECALLBACK______PETWENABLECALLBACK_n__else_n____define__mcgen_PENABLECALLBACK______PENABLECALLBACK_n__endif_nendif_____mcgen_PENABLECALLBACK_n_nif__defined__mcgen_PASTE2__n___This_macro_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._ndefine__mcgen_PASTE2_a__b___mcgen_PASTE2_imp_a__b__ndefine__mcgen_PASTE2_imp_a__b__ab_nendif_____mcgen_PASTE2_n_nif__defined__mcgen_PASTE3__n___This_macro_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._ndefine__mcgen_PASTE3_a__b__c___mcgen_PASTE3_imp_a__b__c__ndefine__mcgen_PASTE3_imp_a__b__c__ab_c_nendif_____mcgen_PASTE3_n_n___n___Macro_validation_n___n_n___Validate_MCGEN_EVENTREGISTER:_n_n___Trigger_an_error_if_MCGEN_EVENTREGISTER_is_not_an_unqualified__simple__identifier:_nstruct__mcgen_PASTE2_MCGEN_EVENTREGISTER_definition_must_be_an_unqualified_identifier___MCGEN_EVENTREGISTER___n_n___Trigger_an_error_if_MCGEN_EVENTREGISTER_is_redefined:_ntypedef_struct__mcgen_PASTE2_MCGEN_EVENTREGISTER_definition_must_be_an_unqualified_identifier___MCGEN_EVENTREGISTER__n____MCGEN_EVENTREGISTER_must_not_be_redefined_between_headers__n_n___Trigger_an_error_if_MCGEN_EVENTREGISTER_is_defined_as_a_function_like_macro:_ntypedef_void_MCGEN_EVENTREGISTER_must_not_be_a_functionLike_macro_MCGEN_EVENTREGISTER__ntypedef_int__mcgen_PASTE2_MCGEN_EVENTREGISTER_must_not_be_a_functionLike_macro___MCGEN_EVENTREGISTER___n_n___Validate_MCGEN_EVENTUNREGISTER:_n_n___Trigger_an_error_if_MCGEN_EVENTUNREGISTER_is_not_an_unqualified__simple__identifier:_nstruct__mcgen_PASTE2_MCGEN_EVENTUNREGISTER_definition_must_be_an_unqualified_identifier___MCGEN_EVENTUNREGISTER___n_n___Trigger_an_error_if_MCGEN_EVENTUNREGISTER_is_redefined:_ntypedef_struct__mcgen_PASTE2_MCGEN_EVENTUNREGISTER_definition_must_be_an_unqualified_identifier___MCGEN_EVENTUNREGISTER__n____MCGEN_EVENTUNREGISTER_must_not_be_redefined_between_headers__n_n___Trigger_an_error_if_MCGEN_EVENTUNREGISTER_is_defined_as_a_function_like_macro:_ntypedef_void_MCGEN_EVENTUNREGISTER_must_not_be_a_functionLike_macro_MCGEN_EVENTUNREGISTER__ntypedef_int__mcgen_PASTE2_MCGEN_EVENTUNREGISTER_must_not_be_a_functionLike_macro___MCGEN_EVENTUNREGISTER___n_n___Validate_MCGEN_EVENTSETINFORMATION:_n_n___Trigger_an_error_if_MCGEN_EVENTSETINFORMATION_is_not_an_unqualified__simple__identifier:_nstruct__mcgen_PASTE2_MCGEN_EVENTSETINFORMATION_definition_must_be_an_unqualified_identifier___MCGEN_EVENTSETINFORMATION___n_n___Trigger_an_error_if_MCGEN_EVENTSETINFORMATION_is_redefined:_ntypedef_struct__mcgen_PASTE2_MCGEN_EVENTSETINFORMATION_definition_must_be_an_unqualified_identifier___MCGEN_EVENTSETINFORMATION__n____MCGEN_EVENTSETINFORMATION_must_not_be_redefined_between_headers__n_n___Trigger_an_error_if_MCGEN_EVENTSETINFORMATION_is_defined_as_a_function_like_macro:_ntypedef_void_MCGEN_EVENTSETINFORMATION_must_not_be_a_functionLike_macro_MCGEN_EVENTSETINFORMATION__ntypedef_int__mcgen_PASTE2_MCGEN_EVENTSETINFORMATION_must_not_be_a_functionLike_macro___MCGEN_EVENTSETINFORMATION___n_n___Validate_MCGEN_EVENTWRITETRANSFER:_n_n___Trigger_an_error_if_MCGEN_EVENTWRITETRANSFER_is_not_an_unqualified__simple__identifier:_nstruct__mcgen_PASTE2_MCGEN_EVENTWRITETRANSFER_definition_must_be_an_unqualified_identifier___MCGEN_EVENTWRITETRANSFER___n_n___Trigger_an_error_if_MCGEN_EVENTWRITETRANSFER_is_redefined:_ntypedef_struct__mcgen_PASTE2_MCGEN_EVENTWRITETRANSFER_definition_must_be_an_unqualified_identifier___MCGEN_EVENTWRITETRANSFER__n____MCGEN_EVENTWRITETRANSFER_must_not_be_redefined_between_headers___n_n___Trigger_an_error_if_MCGEN_EVENTWRITETRANSFER_is_defined_as_a_function_like_macro:_ntypedef_void_MCGEN_EVENTWRITETRANSFER_must_not_be_a_functionLike_macro_MCGEN_EVENTWRITETRANSFER__ntypedef_int__mcgen_PASTE2_MCGEN_EVENTWRITETRANSFER_must_not_be_a_functionLike_macro___MCGEN_EVENTWRITETRANSFER___n]
movdqu xmmword [rsp + 0x440], xmm0
lea rdx, [rsp + 0x440]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
movups xmm0, xmmword [str._nifndef_McGenEventWrite_def_ndefine_McGenEventWrite_def_n_n___This_macro_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._ndefine_McGenEventWrite__mcgen_PASTE2_McGenEventWrite___MCGEN_EVENTWRITETRANSFER__n_n___This_function_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._nDECLSPEC_NOINLINE___inline_nULONG___stdcall_nMcGenEventWrite__n_____In__PMCGEN_TRACE_CONTEXT_Context__n_____In__PCEVENT_DESCRIPTOR_Descriptor__n_____In_opt__LPCGUID_ActivityId__n_____In_range__1__128__ULONG_EventDataCount__n_____Pre_cap__EventDataCount__EVENT_DATA_DESCRIPTOR_EventData_n______n_n____const_USHORT_UNALIGNED_Traits__n_n_______Some_customized_MCGEN_EVENTWRITETRANSFER_macros_might_ignore_ActivityId._n____UNREFERENCED_PARAMETER_ActivityId___n_n____Traits___const_USHORT_UNALIGNED__UINT_PTR_Context__Logger__n_n____if__Traits__NULL___n________EventData_0_.Ptr__0__n________EventData_0_.Size__0__n________EventData_0_.Reserved__0__n_____else__n________EventData_0_.Ptr___ULONG_PTR_Traits__n________EventData_0_.Size__Traits__n________EventData_0_.Reserved__2_____EVENT_DATA_DESCRIPTOR_TYPE_PROVIDER_METADATA_n_____n_n____return_MCGEN_EVENTWRITETRANSFER__n________Context__RegistrationHandle__n________Descriptor__n________ActivityId__n________NULL__n________EventDataCount__n________EventData___n_nendif____McGenEventWrite_def_n]
movdqu xmmword [rsp + 0x450], xmm0
lea rdx, [rsp + 0x450]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
cmp byte [rsp + 0x50], dil
je 0x140007eec
movups xmm0, xmmword [str._nifndef_McGenEventSetInformation_def_ndefine_McGenEventSetInformation_def_n_nif_MCGEN_HAVE_EVENTSETINFORMATION__1_n_____This_macro_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._n__define__mcgen_EVENTSETINFORMATION_SUFFIX___MCGEN_EVENTSETINFORMATION_nelif_MCGEN_HAVE_EVENTSETINFORMATION__2_n__if_MCGEN_USE_KERNEL_MODE_APIS_n_______This_macro_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._n____define__mcgen_EVENTSETINFORMATION_SUFFIX_2K_n__else____MCGEN_USE_KERNEL_MODE_APIS_n_______This_macro_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._n____define__mcgen_EVENTSETINFORMATION_SUFFIX_2U_n__endif____MCGEN_USE_KERNEL_MODE_APIS_nelse____MCGEN_HAVE_EVENTSETINFORMATION__0_n_____This_macro_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._n__define__mcgen_EVENTSETINFORMATION_SUFFIX___0_nendif____MCGEN_HAVE_EVENTSETINFORMATION_n_n___This_macro_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._ndefine_McGenEventSetInformation__mcgen_PASTE2_McGenEventSetInformation____mcgen_EVENTSETINFORMATION_SUFFIX__n_n___This_function_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._n_IRQL_requires_max__PASSIVE_LEVEL__nDECLSPEC_NOINLINE___inline_nULONG___stdcall_nMcGenEventSetInformation__n_____In__REGHANDLE_RegHandle__n_____In__EVENT_INFO_CLASS_InformationClass__n_____In_opt_bytecount__InformationLength__PVOID_EventInformation__n_____In__ULONG_InformationLength_n______n__n_nRoutine_Description:_n_n____This_function_invokes_EventSetInformation_to_provide_additional_information_n____to_the_ETW_runtime._n_n____Note_that_the_implementation_of_this_function_depends_on_the_values_of_n____the_MCGEN_HAVE_EVENTSETINFORMATION_and_MCGEN_EVENTSETINFORMATION_macros._n____Depending_on_the_values_of_these_macros__this_function_may_call_n____EventSetInformation_directly__may_dynamically_load_EventSetInformation_n____via_GetProcAddress__or_may_call_a_replacement_function._n_nArguments:_n_n____RegHandle___Registration_handle_returned_by_EventRegister._n_n____InformationClass___Type_of_operation_to_be_performed_on_the_registration_n_______________________object._n_n____EventInformation___The_input_buffer._n_n____InformationLength___Size_of_the_input_buffer._n_n____n_n____ULONG_Error__n_nif_MCGEN_HAVE_EVENTSETINFORMATION__1_n_npragma_warning_suppress:_6387_____Its_ok_for_EventInformation_to_be_null_if_InformationLength_is_0._n____Error__MCGEN_EVENTSETINFORMATION__n________RegHandle__n________InformationClass__n________EventInformation__n________InformationLength___n_nelif_MCGEN_HAVE_EVENTSETINFORMATION__2_n_nif_MCGEN_USE_KERNEL_MODE_APIS_n____typedef_NTSTATUS_NTAPI_PFEtwSetInformation___n_________In__REGHANDLE_regHandle__n_________In__EVENT_INFO_CLASS_informationClass__n_________In_opt_bytecount__informationLength__PVOID_eventInformation__n_________In__ULONG_informationLength___n____static_UNICODE_STRING_strEtwSetInformation___n________sizeof_L_EtwSetInformation_____2__n________sizeof_L_EtwSetInformation_____2__n________L_EtwSetInformation__n______n____PFEtwSetInformation_pfEtwSetInformation__npragma_warning_push__npragma_warning_disable:_4055_____Allow_the_cast_from_a_PVOID_to_a_PFN_n____pfEtwSetInformation___PFEtwSetInformation_MmGetSystemRoutineAddress_strEtwSetInformation___npragma_warning_pop__n____if__pfEtwSetInformation__n_____n________Error__pfEtwSetInformation__n____________RegHandle__n____________InformationClass__n____________EventInformation__n____________InformationLength___n_____n____else_n_____n________Error__STATUS_NOT_SUPPORTED__n_____nelse_____MCGEN_USE_KERNEL_MODE_APIS_n____HMODULE_hEventing__n____Error__ERROR_NOT_SUPPORTED__n____if__GetModuleHandleExW_0__L_api_ms_win_eventing_provider_l1_1_0___hEventing___n________GetModuleHandleExW_0__L_advapi32___hEventing___n_____n________typedef_ULONG_WINAPI_PFEventSetInformation___n_____________In__REGHANDLE_regHandle__n_____________In__EVENT_INFO_CLASS_informationClass__n_____________In_opt_bytecount__informationLength__PVOID_eventInformation__n]
movdqu xmmword [rsp + 0x460], xmm0
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
movups xmm0, xmmword [str._nifndef_McGenEventRegisterContext_def_ndefine_McGenEventRegisterContext_def_n_n___This_macro_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._ndefine_McGenEventRegisterContext__mcgen_PASTE3_McGenEventRegisterContext___MCGEN_EVENTREGISTER___mcgen_EVENTSETINFORMATION_SUFFIX__n_npragma_warning_push__npragma_warning_disable:6103__n___This_function_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._n_IRQL_requires_max__PASSIVE_LEVEL__nDECLSPEC_NOINLINE___inline_nULONG___stdcall_nMcGenEventRegisterContext__n_____In__LPCGUID_ProviderId__n_____In_opt___mcgen_PENABLECALLBACK_EnableCallback__n_____In_opt__PVOID_CallbackContext__n_____Inout__MCGEN_TRACE_CONTEXT_Context_n______n__n_nRoutine_Description:_n_n____This_function_registers_the_provider_with_ETW_and_registers_provider_n____traits._The_EventRegister_ProviderName__macro_will_use_this_function_n____instead_of_McGenEventRegister_if_the_provider_has_traits_to_be_registered._n_nArguments:_n_n____ProviderId___Provider_ID_to_register_with_ETW._n_n____EnableCallback___Callback_to_be_used._n_n____CallbackContext___Context_for_the_callback._n_n____Context___Provider_context._n_nRemarks:_n_n____Should_not_be_called_if_the_provider_is_already_registered__i.e._should_not_n____be_called_if_Context__RegistrationHandle___0_._Repeatedly_registering_a_n____provider_is_a_bug_and_may_indicate_a_race_condition._n_n____n_n____ULONG_Error__n_n____if__Context__RegistrationHandle___0__n_____nif_MCGEN_USE_KERNEL_MODE_APIS_n________Error___ULONG_STATUS_INVALID_PARAMETER__nelse_n________Error__ERROR_INVALID_PARAMETER__nendif_n_____n____else_n_____n________Error__MCGEN_EVENTREGISTER__n____________ProviderId__n____________EnableCallback__n____________CallbackContext__n____________Context__RegistrationHandle___n________if__Error__0__Context__Logger___0__n_________n_____________void_McGenEventSetInformation__n________________Context__RegistrationHandle__n_________________EVENT_INFO_CLASS_2_____EventProviderSetTraits_n_________________void__UINT_PTR_Context__Logger__n_________________USHORT_const_UNALIGNED__UINT_PTR_Context__Logger___n_________n_____n_n____return_Error__n_npragma_warning_pop__nendif____McGenEventRegisterContext_def_n]
movdqu xmmword [rsp + 0x470], xmm0
lea rdx, [rsp + 0x470]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
lea rax, str._nif__defined_McGenEventRegisterUnregister__ndefine_McGenEventRegisterUnregister_n
mov qword [rsp + 0x1c0], rax
mov qword [rsp + 0x1c8], 0x51
movaps xmm0, xmmword [rsp + 0x1c0]
movdqa xmmword [rsp + 0x480], xmm0
lea rdx, [rsp + 0x480]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
movups xmm0, xmmword [str._n___This_macro_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._ndefine_McGenEventRegister__mcgen_PASTE2_McGenEventRegister___MCGEN_EVENTREGISTER__n_npragma_warning_push__npragma_warning_disable:6103__n___This_function_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._nDECLSPEC_NOINLINE___inline_nULONG___stdcall_nMcGenEventRegister__n_____In__LPCGUID_ProviderId__n_____In_opt___mcgen_PENABLECALLBACK_EnableCallback__n_____In_opt__PVOID_CallbackContext__n_____Inout__PREGHANDLE_RegHandle_n______n__n_nRoutine_Description:_n_n____This_function_registers_the_provider_with_ETW._n_nArguments:_n_n____ProviderId___Provider_ID_to_register_with_ETW._n_n____EnableCallback___Callback_to_be_used._n_n____CallbackContext___Context_for_the_callback._n_n____RegHandle___Pointer_to_registration_handle._n_nRemarks:_n_n____Should_not_be_called_if_the_provider_is_already_registered__i.e._should_not_n____be_called_if_RegHandle___0_._Repeatedly_registering_a_provider_is_a_bug_n____and_may_indicate_a_race_condition._However__for_compatibility_with_previous_n____behavior__this_function_will_return_SUCCESS_in_this_case._n_n____n_n____ULONG_Error__n_n____if__RegHandle___0__n_____n________Error__0_____ERROR_SUCCESS_n_____n____else_n_____n________Error__MCGEN_EVENTREGISTER_ProviderId__EnableCallback__CallbackContext__RegHandle___n_____n_n____return_Error__n_npragma_warning_pop__n]
movdqu xmmword [rsp + 0x490], xmm0
lea rdx, [rsp + 0x490]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
movups xmm0, xmmword [str._n___This_macro_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._ndefine_McGenEventUnregister__mcgen_PASTE2_McGenEventUnregister___MCGEN_EVENTUNREGISTER__n_n___This_function_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._nDECLSPEC_NOINLINE___inline_nULONG___stdcall_nMcGenEventUnregister__Inout__PREGHANDLE_RegHandle__n__n_nRoutine_Description:_n_n____Unregister_from_ETW_and_set_RegHandle__0._n_nArguments:_n_n____RegHandle___the_pointer_to_the_provider_registration_handle_n_nRemarks:_n_n____If_provider_has_not_been_registered__i.e._if_RegHandle__0___n____return_SUCCESS._It_is_safe_to_call_McGenEventUnregister_even_if_the_n____call_to_McGenEventRegister_returned_an_error._n_n____n_n____ULONG_Error__n_n____if_RegHandle__0__n_____n________Error__0_____ERROR_SUCCESS_n_____n____else_n_____n________Error__MCGEN_EVENTUNREGISTER_RegHandle___n________RegHandle___REGHANDLE_0__n_____n_n____return_Error__n_n]
movdqu xmmword [rsp + 0x4a0], xmm0
lea rdx, [rsp + 0x4a0]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
lea rax, str._nendif____McGenEventRegisterUnregister_n
mov qword [rsp + 0x1d0], rax
mov qword [rsp + 0x1d8], 0x28
movaps xmm0, xmmword [rsp + 0x1d0]
movdqa xmmword [rsp + 0x4b0], xmm0
lea rdx, [rsp + 0x4b0]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
cmp byte [0x1400a1309], dil
jne 0x140007ff3
lea rax, str._n___n___MCGEN_ENABLE_CHECK_macro:_n___Determines_whether_the_specified_event_would_be_considered_as_enabled_n___based_on_the_state_of_the_specified_context._Slighly_faster_than_calling_n___McGenEventTracingEnabled_directly._n___nifndef_MCGEN_ENABLE_CHECK_ndefine_MCGEN_ENABLE_CHECK_Context__Descriptor___Context.IsEnabled__McGenEventTracingEnabled_Context__Descriptor___nendif_n
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x1e8], 0x178
movaps xmm0, xmmword [rsp + 0x1e0]
movdqa xmmword [rsp + 0x4c0], xmm0
lea rdx, [rsp + 0x4c0]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
movups xmm0, xmmword [str._nifndef__mcgen_EVENT_BIT_SET_n__if_defined__M_IX86___defined__M_X64__n_______This_macro_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._n____define__mcgen_EVENT_BIT_SET_EnableBits__BitPosition______const_unsigned_char_EnableBits__BitPosition____3____1u_____BitPosition__7______0__n__else____CPU_type_n_______This_macro_is_for_use_by_MC_generated_code_and_should_not_be_used_directly._n____define__mcgen_EVENT_BIT_SET_EnableBits__BitPosition____EnableBits_BitPosition____5____1u_____BitPosition__31______0__n__endif____CPU_type_nendif_____mcgen_EVENT_BIT_SET_n]
movdqu xmmword [rsp + 0x4d0], xmm0
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
movups xmm0, xmmword [str._nendif____MCGEN_DISABLE_PROVIDER_CODE_GENERATION_n]
movdqu xmmword [rsp + 0x4e0], xmm0
lea rdx, [rsp + 0x4e0]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
mov rdx, qword [r14 + 8]
sub rdx, qword [r14]
sar rdx, 3
lea rcx, [rsp + 0xa0]
call fcn.140011e34
cmp byte [0x1400a1c31], dil
jne 0x140008065
cmp byte [0x1400a1c30], dil
je 0x1400080f9
mov rdx, r14
lea rcx, [rsp + 0x540]
call fcn.1400153ec
mov esi, eax
test eax, eax
je 0x140008080
jmp 0x1400084f3
call fcn.140013c6c
mov rax, qword [section..data]
mov qword [rsp + 0x590], rax
lea rcx, [rsp + 0x540]
call fcn.1400152e8
mov esi, eax
test eax, eax
je 0x1400080ac
jmp 0x1400084f3
mov rdx, r14
lea rcx, [rsp + 0x540]
call fcn.140016300
mov rdx, r14
lea rcx, [rsp + 0x540]
call fcn.1400164e8
nop
jmp 0x1400080f9
mov dword [rsp + 0x54], edi
mov rcx, qword [r14]
mov rax, qword [r14 + 8]
sub rax, rcx
sar rax, 3
test rax, rax
je 0x1400083be
mov r15, rdi
mov rax, qword [rcx + r15*8]
mov rdx, rcx
cmp byte [rax + 0x84], dil
je 0x14000815e
cmp byte [0x1400a1308], dil
je 0x14000815e
cmp byte [0x1400a1c34], dil
je 0x14000815e
mov rax, qword [rax + 0x20]
test rax, rax
je 0x140008147
mov r8, qword [rax]
jmp 0x14000814a
mov r8, rdi
lea rdx, str._n___n___Warning_:_Classic_Crimson_Provider_Ignored_n___Provider_:__ls_n___n
lea rcx, [rsp + 0x40]
call fcn.140006878
mov rdx, qword [r14]
lea r13, [r15 + r15*2]
mov rax, qword [rsp + 0xa0]
lea r8, [rax + r13*8]
mov rdx, qword [rdx + r15*8]
mov rcx, qword [rsp + 0x98]
call fcn.140043a48
mov esi, eax
test eax, eax
jns 0x1400081c5
cmp byte [0x1400a1308], dil
je 0x1400081c5
mov r8d, eax
lea rdx, str.GetManifestData:_Failed_with_Error_0x_x
lea rcx, [rsp + 0x40]
call fcn.140006878
mov ecx, 2
call sub.api_ms_win_crt_private_l1_1_0.dll__o___acrt_iob_func
mov rcx, rax
mov r9d, esi
mov r8, qword [0x1400a1c38]
lea rdx, str._ls_:_error_:_GetManifestData:_Failed_with_Error_0x_x_n
call fcn.140051704
mov r8, qword [r14]
cmp byte [0x1400a1c35], dil
jne 0x140008313
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0xe0], rdi
movdqu xmmword [rsp + 0xb8], xmm0
mov qword [rsp + 0xc8], rdi
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rdi
mov rax, qword [rsp + 0xa0]
lea rdx, [rax + r13*8]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xd0]
mov r8, qword [r8 + r15*8]
lea rcx, [rsp + 0x40]
call fcn.14000cf9c
mov esi, eax
test eax, eax
jne 0x140008445
cmp byte [0x1400a1c31], dil
jne 0x14000825a
cmp byte [0x1400a1c30], dil
je 0x1400082a8
mov rax, qword [r14]
mov r8, qword [rax + r15*8]
mov rax, qword [rsp + 0xa0]
lea rdx, [rax + r13*8]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x540]
call fcn.1400155b0
mov esi, eax
test eax, eax
jne 0x140008445
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400082f6
mov rdx, qword [rsp + 0x78]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400082e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000847c
call fcn.140050978
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rdi
lea rcx, [rsp + 0xb8]
call fcn.1400120a4
nop
lea rcx, [rsp + 0xd0]
call fcn.1400120a4
jmp 0x140008337
mov rax, qword [rsp + 0xa0]
lea rdx, [rax + r13*8]
mov r8, qword [r8 + r15*8]
lea rcx, [rsp + 0x40]
call fcn.14000c464
mov esi, eax
test eax, eax
jne 0x1400084ed
cmp byte [0x1400a1c36], dil
je 0x140008397
cmp dword [rsp + 0x54], edi
je 0x140008375
mov ecx, 0xa
mov rdx, qword [rsp + 0x80]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_fputwc]
nop dword [rax + rax]
mov ecx, 0xffff
cmp ax, cx
jne 0x140008375
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__errno]
nop dword [rax + rax]
mov rax, qword [r14]
mov r8, qword [rax + r15*8]
mov rax, qword [rsp + 0xa0]
lea rdx, [rax + r13*8]
lea rcx, [rsp + 0x80]
call fcn.140009e30
mov esi, eax
mov r8d, dword [rsp + 0x54]
inc r8d
mov dword [rsp + 0x54], r8d
mov rcx, qword [r14]
mov rax, qword [r14 + 8]
sub rax, rcx
sar rax, 3
mov r15d, r8d
cmp r15, rax
jb 0x140008117
cmp byte [0x1400a1c34], dil
je 0x1400084d2
lea rcx, [rsp + 0x40]
cmp byte [0x1400a1c35], dil
je 0x140008489
call fcn.140010ec8
mov esi, eax
test eax, eax
jne 0x1400084ed
cmp byte [0x1400a1309], dil
jne 0x1400084d2
lea rcx, [rsp + 0x40]
call fcn.1400115d8
mov esi, eax
test eax, eax
jne 0x1400084ed
jmp 0x1400084d2
call fcn.140050978
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rdi
lea rcx, [rsp + 0xb8]
call fcn.1400120a4
nop
lea rcx, [rsp + 0xd0]
call fcn.1400120a4
jmp 0x1400084ed
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140008425
mov rdx, qword [rsp + 0x78]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
mov rax, rcx
jb 0x140008412
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008412
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__invalid_parameter_noinfo_noreturn]
nop dword [rax + rax]
nop
call fcn.14000fc80
mov esi, eax
test eax, eax
jne 0x1400084ed
lea rax, str._nif_defined___cplusplus__n_nendif_n
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], 0x23
movaps xmm0, xmmword [rsp + 0x110]
movdqa xmmword [rsp + 0x4f0], xmm0
lea rdx, [rsp + 0x4f0]
lea rcx, [rsp + 0x40]
call fcn.1400068c4
cmp byte [0x1400a1c35], dil
jne 0x1400084ed
mov rdx, qword [rsp + 0x98]
lea rcx, [rsp + 0x40]
call fcn.140007208
mov r13d, 2
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400085df
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_ferror]
nop dword [rax + rax]
mov r14d, eax
test eax, eax
je 0x14000853e
test esi, esi
jne 0x14000853e
mov ecx, r13d
call sub.api_ms_win_crt_private_l1_1_0.dll__o___acrt_iob_func
mov rcx, rax
mov r9d, r14d
mov r8, qword [0x1400a1c38]
lea rdx, str._ls_:_error_:_I_O_error__u_n
call fcn.140051704
mov esi, 0x490
cmp byte [rsp + 0x48], dil
je 0x140008575
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_fclose]
nop dword [rax + rax]
test eax, eax
je 0x140008575
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__errno]
nop dword [rax + rax]
mov r14d, dword [rax]
or eax, 0xffffffff
test r14d, r14d
cmove r14d, eax
jmp 0x140008578
mov r14d, edi
mov byte [rsp + 0x48], dil
mov qword [rsp + 0x40], rdi
test r14d, r14d
je 0x1400085b1
test esi, esi
jne 0x1400085b1
mov ecx, r13d
call sub.api_ms_win_crt_private_l1_1_0.dll__o___acrt_iob_func
mov rcx, rax
mov r9d, r14d
mov r8, qword [0x1400a1c38]
lea rdx, str._ls_:_error_:_I_O_error__u_n
call fcn.140051704
mov esi, 0x490
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x1400085df
test al, 0x20
je 0x1400085df
and eax, 0xffffffdf
mov edx, eax
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
nop dword [rax + rax]
test esi, esi
je 0x1400085f4
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
nop
lea rcx, [rsp + 0x5d8]
cmp byte [0x1400a1308], dil
je 0x140008744
call fcn.140006700
lea rcx, [rsp + 0x5b8]
call fcn.140006700
lea rcx, [rsp + 0x598]
call fcn.140006700
cmp byte [rsp + 0x588], dil
je 0x140008646
mov rcx, qword [rsp + 0x580]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_fclose]
nop dword [rax + rax]
cmp byte [rsp + 0x578], dil
je 0x140008664
mov rcx, qword [rsp + 0x570]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_fclose]
nop dword [rax + rax]
cmp byte [rsp + 0x568], dil
je 0x140008682
mov rcx, qword [rsp + 0x560]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_fclose]
nop dword [rax + rax]
cmp byte [rsp + 0x558], dil
je 0x1400086a0
mov rcx, qword [rsp + 0x550]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_fclose]
nop dword [rax + rax]
cmp byte [rsp + 0x548], dil
je 0x1400086bf
mov rcx, qword [rsp + 0x540]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_fclose]
nop dword [rax + rax]
nop
cmp byte [rsp + 0x48], dil
je 0x1400086d8
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_fclose]
nop dword [rax + rax]
nop
cmp byte [rsp + 0x88], dil
je 0x1400086f7
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_fclose]
nop dword [rax + rax]
nop
mov rax, rdi
xchg qword [0x1400b6860], rax
mov rax, qword [rsp + 0x58]
mov r14, qword [rax + 8]
jmp 0x140008739
mov r8, qword [r14 + 0x10]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.140012934
mov rbx, r14
mov r14, qword [r14]
lea rcx, [rbx + 0x20]
call fcn.140006700
mov rdx, r12
mov rcx, rbx
call fcn.140050978
cmp byte [r14 + 0x19], dil
je 0x14000870c
jmp 0x14000887c
call fcn.140006700
lea rcx, [rsp + 0x5b8]
call fcn.140006700
lea rcx, [rsp + 0x598]
call fcn.140006700
cmp byte [rsp + 0x588], dil
je 0x140008781
mov rcx, qword [rsp + 0x580]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_fclose]
nop dword [rax + rax]
cmp byte [rsp + 0x578], dil
je 0x14000879f
mov rcx, qword [rsp + 0x570]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_fclose]
nop dword [rax + rax]
cmp byte [rsp + 0x568], dil
je 0x1400087bd
mov rcx, qword [rsp + 0x560]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_fclose]
nop dword [rax + rax]
cmp byte [rsp + 0x558], dil
je 0x1400087db
mov rcx, qword [rsp + 0x550]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_fclose]
nop dword [rax + rax]
cmp byte [rsp + 0x548], dil
je 0x1400087fa
mov rcx, qword [rsp + 0x540]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_fclose]
nop dword [rax + rax]
nop
cmp byte [rsp + 0x48], dil
je 0x140008813
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_fclose]
nop dword [rax + rax]
nop
cmp byte [rsp + 0x88], dil
je 0x140008832
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_fclose]
nop dword [rax + rax]
nop
mov rax, rdi
xchg qword [0x1400b6860], rax
mov rax, qword [rsp + 0x58]
mov rsi, qword [rax + 8]
jmp 0x140008874
mov r8, qword [rsi + 0x10]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.140012934
mov rbx, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x20]
call fcn.140006700
mov rdx, r12
mov rcx, rbx
call fcn.140050978
cmp byte [rsi + 0x19], dil
je 0x140008847
mov esi, edi
mov rdx, r12
mov rcx, qword [rsp + 0x58]
call fcn.140050978
nop
lea rcx, [rsp + 0xa0]
call fcn.140011f14
mov eax, esi
jmp 0x1400088f8
mov rsi, qword [rcx + 8]
cmp byte [rsi + 0x19], dil
jne 0x1400088dd
mov r8, qword [rsi + 0x10]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.140012934
mov rbx, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x20]
call fcn.140006700
mov rdx, r12
mov rcx, rbx
call fcn.140050978
cmp byte [rsi + 0x19], dil
je 0x1400088a5
mov rcx, qword [rsp + 0x58]
mov rdx, r12
call fcn.140050978
nop
lea rcx, [rsp + 0xa0]
call fcn.140011f14
mov eax, 0x57
mov rcx, qword [rsp + 0x600]
xor rcx, rsp
call fcn.140050950
lea r11, [rsp + 0x610]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret