EtwpFreeUserBufferSpace

VOID __fastcall EtwpFreeUserBufferSpace(_ETW_REALTIME_CONSUMER *Prc, UINT64 BufferSize, _WMI_BUFFER_HEADER *UserBuffer){
  unsigned __int8 *ReservedBufferSpace; 
  ULONG_PTR RegionSize; 
  PVOID BaseAddress; 
  BaseAddress = UserBuffer;
  RegionSize = BufferSize;
  ReservedBufferSpace = Prc->ReservedBufferSpace;
  if( UserBuffer < (_WMI_BUFFER_HEADER *)ReservedBufferSpace
    || UserBuffer >= (_WMI_BUFFER_HEADER *)&ReservedBufferSpace[Prc->ReservedBufferSpaceSize] )
  {
    ZwFreeVirtualMemory(Prc->ProcessHandle, &BaseAddress, &RegionSize, 0x8000ui64);
  }
  else
  {
    RtlInterlockedClearBitRun(
      &Prc->ReservedBufferSpaceBitMap,
      (unsigned int)(((char *)UserBuffer - (char *)ReservedBufferSpace) / 4096),
      (((_DWORD)BufferSize + 4095) & 0xFFFFF000) >> 12);
  }
}

Referenced by: