EtwpRealtimeFlushSavedBuffers

INT64 __fastcall EtwpRealtimeFlushSavedBuffers(_WMI_LOGGER_CONTEXT *LoggerContext){
  char *PoolWithTag; 
  char *v4; 
  int v5; 
  __int64 v6; 
  __int64 v7; 
  __int64 v8; 
  bool v9; 
  if( !*((_DWORD *)LoggerContext + 110) || !*((_DWORD *)LoggerContext + 90) )
    return 0i64;
  PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPool, *((unsigned int *)LoggerContext + 1), 0x50777445ui64);
  v4 = PoolWithTag;
  if( PoolWithTag )
  {
    memset((INT64)PoolWithTag, 0i64);
    v5 = *((_DWORD *)LoggerContext + 110);
    if( v5 )
    {
      while( *((_DWORD *)LoggerContext + 90) )
      {
        v6 = *((_QWORD *)LoggerContext + 51);
        if( EtwpRealtimeRestoreBuffer((__int64)LoggerContext, v4) < 0 )
        {
          *((_DWORD *)LoggerContext + 69) += *((_DWORD *)LoggerContext + 110);
          *((_DWORD *)LoggerContext + 110) = 0;
          *((_QWORD *)LoggerContext + 53) = 0i64;
          *((_DWORD *)LoggerContext + 116) = 3;
          EtwpSendSessionNotification((__int64)LoggerContext, 4u, 0xC0000102);
          EtwpRealtimeZeroTruncateLogfile(LoggerContext);
          ExFreePoolWithTag(v4, 0);
          if( (*((_DWORD *)LoggerContext + 208) & 1) != 0 )
            EtwpRealtimeResetReferenceTime((INT64)LoggerContext);
          return 3221225730i64;
        }
        if( EtwpRealtimeDeliverBuffer(LoggerContext, (_WMI_BUFFER_HEADER *)v4) < 0 )
        {
          v5 = *((_DWORD *)LoggerContext + 110);
          *((_QWORD *)LoggerContext + 51) = v6;
          break;
        }
        if( (*((_DWORD *)LoggerContext + 208) & 1) != 0 && *((_WORD *)v4 + 27) == 3 )
          *((_OWORD *)LoggerContext + 28) = *(_OWORD *)(v4 + 56);
        v7 = *((_QWORD *)LoggerContext + 53);
        v5 = *((_DWORD *)LoggerContext + 110) - 1;
        *((_DWORD *)LoggerContext + 110) = v5;
        v8 = v7 - *((unsigned int *)v4 + 12);
        v9 = *((int *)LoggerContext + 4) < 0;
        *((_QWORD *)LoggerContext + 53) = v8;
        if( v9
          && *((_QWORD *)LoggerContext + 54) - v8 > (unsigned __int64)(unsigned int)(*((_DWORD *)LoggerContext + 1)
                                                                                   * *((_DWORD *)LoggerContext + 63)) )
        {
          _InterlockedExchange((volatile __int32 *)LoggerContext + 4, 0);
          v5 = *((_DWORD *)LoggerContext + 110);
        }
        if( !v5 )
          goto LABEL_14;
      }
      if( v5 )
        goto LABEL_15;
    }
LABEL_14:
    EtwpRealtimeZeroTruncateLogfile(LoggerContext);
LABEL_15:
    ExFreePoolWithTag(v4, 0);
    return 0i64;
  }
  return 3221225495i64;
}

Referenced by: