KiSaveCurrentEtwTraceBuffer

VOID __stdcall KiSaveCurrentEtwTraceBuffer(){
  __int64 v0; 
  __int64 v1; 
  VOID *v2; 
  __int64 v3; 
  __int64 v4; 
  VOID *v5; 
  _ETW_BUFFER_INFORMATION BufferInfo[4]; 

  *(_OWORD *)BufferInfo = 0i64;
  if( EtwGetProcessorBuffer(2ui64, KeGetCurrentPrcb()->Number, BufferInfo) >= 0 )
  {
    v0 = 0x2000i64;
    v1 = *(_QWORD *)BufferInfo + (unsigned int)BufferInfo[3];
    KiCurrentEtwBufferBase = *(_QWORD *)BufferInfo;
    KiCurrentEtwBufferOffset = v1;
    if( (unsigned int)BufferInfo[3] >= 0x2000ui64 )
    {
      v2 = (VOID *)(v1 - 0x2000);
    }
    else
    {
      v0 = (unsigned int)(v1 - BufferInfo[0]);
      v2 = *(VOID **)BufferInfo;
    }
    IoAddTriageDumpDataBlock(v2, (_BYTE *)v0);
    IoAddTriageDumpDataBlock(&KiCurrentEtwBufferBase, (_BYTE *)8);
    IoAddTriageDumpDataBlock(&KiCurrentEtwBufferOffset, (_BYTE *)8);
  }
  if( *(&stru_140C452E0 + 612)
    && EtwGetProcessorBuffer((unsigned __int16)TraceHandle, KeGetCurrentPrcb()->Number, BufferInfo) >= 0 )
  {
    v3 = 4096i64;
    v4 = *(_QWORD *)BufferInfo + (unsigned int)BufferInfo[3];
    KiCurrentErrLogBufferBase = *(_QWORD *)BufferInfo;
    KiCurrentErrLogBufferOffset = v4;
    if( (unsigned int)BufferInfo[3] >= 0x1000ui64 )
    {
      v5 = (VOID *)(v4 - 4096);
    }
    else
    {
      v3 = (unsigned int)(v4 - BufferInfo[0]);
      v5 = *(VOID **)BufferInfo;
    }
    IoAddTriageDumpDataBlock(v5, (_BYTE *)v3);
    IoAddTriageDumpDataBlock(&KiCurrentErrLogBufferBase, (_BYTE *)8);
    IoAddTriageDumpDataBlock(&KiCurrentErrLogBufferOffset, (_BYTE *)8);
  }
}

Referenced by: