EtwpBufferingModeFlush
INT64 __fastcall EtwpBufferingModeFlush(_WMI_LOGGER_CONTEXT *LoggerContext){
unsigned int v1;
int LogFile;
__int64 v3;
__int64 UsedProcessorCount;
__int64 v6;
_QWORD *v7;
unsigned __int64 v8;
unsigned __int32 v9;
signed __int64 i;
signed __int64 v11;
__int64 v12;
_QWORD *v13;
__int64 v14;
__int64 v15;
__int64 v16;
_QWORD *v17;
signed __int32 v18;
signed __int32 v19;
_WMI_BUFFER_HEADER *NextBuffer;
unsigned __int64 v21;
__int64 v22;
char *j;
_WMI_BUFFER_HEADER *v24;
void *v25;
unsigned int v27;
signed __int64 v28;
unsigned int v29;
__int64 v30;
signed __int64 v31;
signed __int64 v32;
signed __int64 v33;
_WMI_BUFFER_HEADER *v34;
__int64 v35;
_WMI_LOGGER_CONTEXT *k;
signed __int64 v37;
__int64 v38;
signed __int64 v39;
signed __int64 v40;
char *v41;
v1 = *((_DWORD *)LoggerContext + 1);
LogFile = 0;
v3 = *(_DWORD *)LoggerContext;
UsedProcessorCount = (unsigned int)EtwpQueryUsedProcessorCount((INT64)LoggerContext);
if( EtwpFileSystemReady )
_InterlockedOr((volatile signed __int32 *)LoggerContext + 208, 4u);
if( !*((_QWORD *)LoggerContext + 26) )
return(unsigned int)LogFile;
LogFile = EtwpCreateLogFile(LoggerContext, 0);
if( LogFile < 0 )
{
LABEL_57:
v25 = (void *)*((_QWORD *)LoggerContext + 102);
if( v25 )
{
ZwClose(v25);
*((_QWORD *)LoggerContext + 102) = 0i64;
}
RtlFreeAnsiString((_UNICODE_STRING *)((char *)LoggerContext + 168));
return(unsigned int)LogFile;
}
if( (_DWORD)UsedProcessorCount )
{
v6 = 0i64;
do
{
if( (*((_DWORD *)LoggerContext + 3) & 0x10000000) != 0 )
v7 = (_QWORD *)((char *)LoggerContext + 144);
else
v7 = (_QWORD *)(*(_QWORD *)(*(_QWORD *)(*((_QWORD *)LoggerContext + 135) + 4136i64) + v6) + 8 * v3);
v8 = *v7 & 0xFFFFFFFFFFFFFFF0ui64;
if( v8 )
{
v9 = _InterlockedExchangeAdd((volatile signed __int32 *)(v8 + 8), v1);
if( v9 <= v1 )
*(_DWORD *)(v8 + 4) = v9;
_m_prefetchw(v7);
for( i = *v7; (v8 ^ i) <= 0xF; i = v11 )
{
v11 = _InterlockedCompareExchange64(v7, 0i64, i);
if( i == v11 )
break;
}
if( (i & 0xFFFFFFFFFFFFFFF0ui64) == v8 )
{
_InterlockedExchangeAdd((volatile signed __int32 *)((i & 0xFFFFFFFFFFFFFFF0ui64) + 12), -(i & 0xF));
EtwpPrepareDirtyBuffer((PSTR)LoggerContext, v8);
}
}
v6 += 64i64;
--UsedProcessorCount;
}
while( UsedProcessorCount );
}
EtwpLockUnlockBufferList((INT64)LoggerContext);
if( (*((_DWORD *)LoggerContext + 3) & 0x4000000) != 0 )
{
EtwpBufferingModeCompressionFlush((__int64)LoggerContext);
v12 = *((_QWORD *)LoggerContext + 103) + 1i64;
if( v12 >= 0 )
{
v13 = (_QWORD *)((char *)LoggerContext + 96);
while( 1 )
{
--v12;
v14 = 0i64;
v15 = *v13 - 56i64;
if( (_QWORD *)*v13 == v13 )
v15 = 0i64;
if( !v15 )
goto LABEL_56;
while( 1 )
{
v16 = *(_QWORD *)(v15 + 24);
if( v16 == v12 )
break;
if( v16 < v12 && (!v14 || v16 > *(_QWORD *)(v14 + 24)) )
v14 = v15;
v17 = *(_QWORD **)(v15 + 56);
v15 = (__int64)(v17 - 7);
if( v17 == v13 )
v15 = 0i64;
if( !v15 )
goto LABEL_36;
}
v14 = v15;
LABEL_36:
if( !v14 )
goto LABEL_56;
v18 = *(_DWORD *)(v14 + 44);
if( (unsigned int)(v18 - 4) <= 1 )
{
v19 = _InterlockedCompareExchange((volatile signed __int32 *)(v14 + 44), 3, v18);
if( v18 == v19 )
{
if( *(_QWORD *)(v14 + 24) == v12 )
{
EtwpWaitForBufferReferenceCount((_WMI_BUFFER_HEADER *)v14);
if( v19 == 5 )
{
if( *(_DWORD *)(v14 + 8) != 72 )
{
NextBuffer = (_WMI_BUFFER_HEADER *)(v14 + 72);
v21 = v14 + *(unsigned int *)(v14 + 8);
*(_QWORD *)(v14 + 104) = 0i64;
v22 = *(unsigned int *)(v14 + 72);
for( j = (char *)(v14 + 72 + v22);
(unsigned __int64)j < v21;
j = (char *)NextBuffer + NextBuffer->BufferSize )
{
v24 = NextBuffer;
NextBuffer = (_WMI_BUFFER_HEADER *)((char *)NextBuffer + (unsigned int)v22);
NextBuffer->0 = ($CE5421AAA17F992240E21CD59A4E8E5E)v24;
LODWORD(v22) = NextBuffer->BufferSize;
}
do
{
if( (unsigned int)EtwpPrepareHeader((__int64)LoggerContext, (__int64)NextBuffer, 64) != -2147483614 )
LogFile = EtwpFlushBufferToLogfile(LoggerContext, NextBuffer);
NextBuffer = NextBuffer->NextBuffer;
}
while( NextBuffer );
_InterlockedCompareExchange((volatile signed __int32 *)(v14 + 44), v18, 5);
goto LABEL_55;
}
_InterlockedExchange((volatile __int32 *)(v14 + 44), 0);
}
else if( v19 == 4 )
{
if( (unsigned int)EtwpPrepareHeader((__int64)LoggerContext, v14, 0) != -2147483614 )
LogFile = EtwpFlushBufferToLogfile(LoggerContext, (_WMI_BUFFER_HEADER *)v14);
_InterlockedCompareExchange((volatile signed __int32 *)(v14 + 44), v18, 4);
LABEL_55:
if( LogFile < 0 )
goto LABEL_56;
}
}
else
{
_InterlockedCompareExchange((volatile signed __int32 *)(v14 + 44), v18, 3);
}
}
}
if( v12 < 0 )
goto LABEL_56;
}
}
goto LABEL_56;
}
v27 = EtwpQueryUsedProcessorCount((INT64)LoggerContext);
v28 = 0i64;
if( _InterlockedCompareExchange64(
(volatile signed __int64 *)LoggerContext + 162,
*((_QWORD *)LoggerContext + 103),
-1i64) == -1 )
{
if( *((_QWORD *)LoggerContext + 160) )
{
v29 = 0;
if( v27 )
{
v30 = 0i64;
do
{
v31 = *(_QWORD *)(v30 + *((_QWORD *)LoggerContext + 160));
v32 = *(_QWORD *)(v30 + *((_QWORD *)LoggerContext + 161));
if( v31 > v32 )
{
do
{
v33 = v32;
v32 = _InterlockedCompareExchange64(
(volatile signed __int64 *)(*((_QWORD *)LoggerContext + 161) + 8i64 * v29),
v31,
v32);
}
while( v33 != v32 && v31 > v32 );
}
++v29;
v30 += 8i64;
}
while( v29 < v27 );
}
}
do
{
v34 = EtwpFindAndLockBufferForFlushing(LoggerContext, *((_QWORD *)LoggerContext + 162));
v35 = (__int64)v34;
if( !v34 )
break;
EtwpWaitForBufferReferenceCount(v34);
if( (unsigned int)EtwpPrepareHeader((__int64)LoggerContext, v35, 0) != -2147483614 )
{
LogFile = EtwpFlushBufferToLogfile(LoggerContext, (_WMI_BUFFER_HEADER *)v35);
if( !v28 )
v28 = *(_QWORD *)(v35 + 16);
}
_InterlockedDecrement64((volatile signed __int64 *)LoggerContext + 162);
_InterlockedExchange((volatile __int32 *)(v35 + 44), 0);
}
while( LogFile >= 0 );
if( *((_QWORD *)LoggerContext + 161) )
{
for( k = (_WMI_LOGGER_CONTEXT *)*((_QWORD *)LoggerContext + 12); ; k = (_WMI_LOGGER_CONTEXT *)*((_QWORD *)v41 + 7) )
{
v41 = (char *)k - 56;
if( k == (_WMI_LOGGER_CONTEXT *)((char *)LoggerContext + 96) )
v41 = 0i64;
if( !v41 )
break;
v37 = *((_QWORD *)v41 + 2);
v38 = *((unsigned __int16 *)v41 + 20);
if( v37 < v28 && *((_QWORD *)v41 + 3) <= *((_QWORD *)LoggerContext + 162) )
{
v39 = *(_QWORD *)(*((_QWORD *)LoggerContext + 161) + 8 * v38);
do
{
if( v37 <= v39 )
break;
v40 = v39;
v39 = _InterlockedCompareExchange64(
(volatile signed __int64 *)(*((_QWORD *)LoggerContext + 161) + 8 * v38),
v37,
v39);
}
while( v40 != v39 );
}
}
}
LABEL_56:
EtwpFinalizeHeader((__int64)LoggerContext, 0);
*((_QWORD *)LoggerContext + 162) = -1i64;
*((_DWORD *)LoggerContext + 66) = 0;
goto LABEL_57;
}
return 3221225539i64;
}Referenced by:
EtwpFlushTrace