EtwpRealtimeInjectEtwBuffer

NTSTATUS __stdcall EtwpRealtimeInjectEtwBuffer(
        _WMI_LOGGER_CONTEXT *LoggerContext,
        _ETW_REALTIME_CONSUMER *Prc,
        _WMI_BUFFER_HEADER *Buffer){
  _WMI_LOGGER_CONTEXT *v6; 
  volatile signed __int32 *UserBufferListHead; 
  _DWORD *v8; 
  signed __int64 v9; 
  signed __int64 v10; 
  int v11; 
  unsigned int v13; 
  int UserBufferSpace; 
  _WMI_BUFFER_HEADER *UserBuffer; 
  __int64 v16; 
  _ETW_REALTIME_CONSUMER *Prca; 
  _WMI_BUFFER_HEADER *v18; 
  __int64 v19; 
  _KAPC_STATE ApcState; 

  Prca = Prc;
  v18 = Buffer;
  memset(&ApcState, 0, sizeof(ApcState));
  UserBuffer = 0i64;
  if( *((_WORD *)Buffer + 27) == 6 )
  {
    v13 = Prc->EmptyBuffersCount + 1;
    Prc->EmptyBuffersCount = v13;
    if( (LoggerContext->LoggerMode & 0x10000000) != 0 || v13 > 2 )
      return 0;
  }
  else
  {
    Prc->EmptyBuffersCount = 0;
  }
  if( !ExAcquireRundownProtection(&Prc->ProcessObject->RundownProtect) )
    return -1073741558;
  KiStackAttachProcess(Prc->ProcessObject, 0i64, &ApcState);
  *Prc->EventsLostCount = LoggerContext->EventsLost;
  *Prc->BuffersLostCount = LoggerContext->RealTimeBuffersLost;
  v6 = (_WMI_LOGGER_CONTEXT *)(4 * LoggerContext->MaximumBuffers);
  if( *Prc->UserBufferCount < (unsigned int)v6 )
  {
    UserBufferSpace = EtwpFindUserBufferSpace(
                        v6,
                        Prc,
                        (_WMI_BUFFER_HEADER **)*((unsigned int *)Buffer + 12),
                        &UserBuffer);
    if( UserBufferSpace >= 0 )
    {
      memmove(UserBuffer, Buffer, *((_DWORD *)Buffer + 12));
      UserBufferListHead = (volatile signed __int32 *)Prc->UserBufferListHead;
      v8 = (_DWORD *)((char *)UserBuffer + 32);
      if( (Prc->Flags & 0x10) != 0 )
      {
        v19 = (__int64)UserBuffer + 32;
        LODWORD(v9) = *UserBufferListHead;
        do
        {
          *v8 = v9;
          v11 = v9;
          LODWORD(v9) = _InterlockedCompareExchange(UserBufferListHead, (signed __int32)v8, v9);
        }
        while( (_DWORD)v9 != v11 );
        v9 = (unsigned int)v9;
      }
      else
      {
        _m_prefetchw((const void *)UserBufferListHead);
        v9 = *(_QWORD *)UserBufferListHead;
        do
        {
          *(_QWORD *)v8 = v9;
          v10 = v9;
          v9 = _InterlockedCompareExchange64((volatile signed __int64 *)UserBufferListHead, (signed __int64)v8, v9);
        }
        while( v9 != v10 );
      }
      v16 = v9;
      _InterlockedIncrement((volatile signed __int32 *)Prc->UserBufferCount);
      if( !v16 )
        KeSetEvent(Prc->DataAvailableEvent, 0, 0);
    }
  }
  else
  {
    UserBufferSpace = -1073741764;
  }
  KiUnstackDetachProcess(&ApcState, 0i64);
  ExReleaseRundownProtection(&Prc->ProcessObject->RundownProtect);
  return UserBufferSpace;
}

Referenced by: