EtwpAddBinaryInfoEvents

INT64 __fastcall EtwpAddBinaryInfoEvents(
        _WMI_LOGGER_CONTEXT *LoggerContext,
        _WMI_BUFFER_HEADER *Buffer,
        UINT64 BufferSize){
  char v3; 
  int v4; 
  int v5; 
  char v6; 
  __int64 *v8; 
  _WMI_BUFFER_HEADER *v9; 
  int v10; 
  unsigned int v11; 
  INT64 v12; 
  UINT64 DataSize; 
  UINT64 RemainingBufferSize; 
  _WMI_BUFFER_HEADER *Bufferb; 
  UINT64 EventSize; 
  int v19; 
  LODWORD(EventSize) = 0;
  v4 = BufferSize - Buffer->Offset;
  v5 = v3 & 2;
  v6 = v3;
  v19 = v5;
  if( (v3 & 2) != 0 )
    ExAcquirePushLockExclusiveEx((UINT64)LoggerContext + 704, 0i64);
  v8 = (__int64 *)*((_QWORD *)LoggerContext + 128);
  if( v8 != (__int64 *)((char *)LoggerContext + 1024) )
  {
    v9 = Buffer;
    v10 = v6 & 4;
    do
    {
      if( v10 )
        v11 = *((_DWORD *)v8 + 6);
      else
        v11 = *((_DWORD *)v8 + 5);
      if( v11 )
      {
        LODWORD(RemainingBufferSize) = v4;
        LODWORD(DataSize) = 16 * v11 + 4 + *((_DWORD *)v8 + 4);
        v12 = EtwpAddEventToBuffer(v9, 0x43u, &v9[1].TimeStamp, 0i64, DataSize, RemainingBufferSize, &EventSize);
        if( !v12 )
          break;
        *(_DWORD *)v12 = v11;
        Bufferb = (_WMI_BUFFER_HEADER *)(v12 + 4);
        memmove((UINT8 *)(v12 + 4), (UINT8 *)&v8[2 * (*((_DWORD *)v8 + 5) - v11) + 3] + 4, 16i64 * v11);
        memmove(
          (UINT8 *)Bufferb + 16 * v11,
          (UINT8 *)&v8[2 * *((unsigned int *)v8 + 5) + 3] + 4,
          *((unsigned int *)v8 + 4));
        if( v10 )
          *((_DWORD *)v8 + 6) = 0;
        v4 -= EventSize;
      }
      v8 = (__int64 *)*v8;
    }
    while( v8 != (__int64 *)((char *)LoggerContext + 1024) );
    v5 = v19;
  }
  if( v5 )
  {
    if( (_InterlockedExchangeAdd64((volatile signed __int64 *)LoggerContext + 88, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((volatile INT64 *)LoggerContext + 88);
    KeAbPostRelease((char *)LoggerContext + 704);
  }
  return 0i64;
}

Referenced by: