EtwpAddEventToBuffer

INT64 __fastcall EtwpAddEventToBuffer(
        _WMI_BUFFER_HEADER *Buffer,
        UINT16 HookId,
        _LARGE_INTEGER *Timestamp,
        UINT8 *Data,
        UINT64 DataSize,
        UINT64 RemainingBufferSize,
        UINT64 *EventSize){
  unsigned int v8; 
  __int64 Offset; 
  char *v10; 
  INT64 v11; 
  v8 = (DataSize + 23) & 0xFFFFFFF8;
  *(_DWORD *)EventSize = v8;
  if( v8 > (unsigned int)RemainingBufferSize )
    return 0i64;
  Offset = Buffer->Offset;
  v10 = (char *)Buffer + Offset;
  Buffer->Offset = v8 + Offset;
  *((_WORD *)v10 + 2) = DataSize + 16;
  v11 = (INT64)(v10 + 16);
  *(_DWORD *)v10 = -1072627710;
  *((_WORD *)v10 + 3) = HookId;
  *((_LARGE_INTEGER *)v10 + 1) = *Timestamp;
  if( Data )
    memmove((UINT8 *)v10 + 16, Data, (unsigned int)DataSize);
  return v11;
}

Referenced by: