EtwpInitializeCompression

NTSTATUS __stdcall EtwpInitializeCompression(_WMI_LOGGER_CONTEXT *LoggerContext){
  NTSTATUS result; 
  NTSTATUS v3; 
  VOID **v4; 
  unsigned int v5; 
  VOID **PoolWithTag; 
  UINT64 NumberOfBytes; 
  UINT64 v8; 

  LoggerContext->CompressionRatioGuess = 5;
  LODWORD(NumberOfBytes) = 0;
  LODWORD(v8) = 0;
  LoggerContext->PartialBufferCompressionLevel = 3;
  LoggerContext->CompressionWorkItem.WorkerRoutine = (void(__fastcall *)(void *))EtwpCompressionProc;
  LoggerContext->CompressionWorkItem.Parameter = LoggerContext;
  LoggerContext->CompressionWorkItem.List.Flink = 0i64;
  result = RtlGetCompressionWorkSpaceSize(3u, &NumberOfBytes, &v8);
  v3 = result;
  if( result >= 0 )
  {
    if( !(_DWORD)NumberOfBytes
      || (v4 = ExAllocatePoolWithTag(0x200ui64, (unsigned int)NumberOfBytes, 1517777989i64),
          (LoggerContext->CompressionWorkspace = v4) != 0i64) )
    {
      LoggerContext->CompressionLock._bf_0 = 0i64;
      LoggerContext->CompressionDpc.DeferredRoutine = (void(__fastcall *)(_KDPC *, void *, void *, void *))EtwpCompressionDpc;
      LoggerContext->CompressionDpc.TargetInfoAsUlong = 275;
      v5 = 0;
      LoggerContext->CompressionDpc.DeferredContext = LoggerContext;
      LoggerContext->CompressionDpc.DpcData = 0i64;
      LoggerContext->CompressionDpc.ProcessorHistory = 0i64;
      LoggerContext->PlaceholderList.Next = 0i64;
      if( LoggerContext->CompressionRatioGuess )
      {
        while( 1 )
        {
          PoolWithTag = ExAllocatePoolWithTag((unsigned int)LoggerContext->PoolType, 0x48ui64, 1115124805i64);
          if( !PoolWithTag )
            break;
          *((_DWORD *)PoolWithTag + 11) = 6;
          ++v5;
          PoolWithTag[4] = LoggerContext->PlaceholderList.Next;
          LoggerContext->PlaceholderList.Next = (_SINGLE_LIST_ENTRY *)(PoolWithTag + 4);
          if( v5 >= LoggerContext->CompressionRatioGuess )
            goto LABEL_8;
        }
        v3 = -1073741801;
        EtwpFreePlaceholderList(LoggerContext);
      }
      else
      {
LABEL_8:
        _InterlockedExchange(&LoggerContext->CompressionOn, 1);
      }
      return v3;
    }
    else
    {
      return -1073741801;
    }
  }
  return result;
}

Referenced by: