EtwpFlushBufferToLogfile

INT64 __fastcall EtwpFlushBufferToLogfile(_WMI_LOGGER_CONTEXT *LoggerContext, _WMI_BUFFER_HEADER *Buffer){
  __int64 v2; 
  unsigned __int64 BufferSize; 
  __int64 v6; 
  int v7; 
  unsigned __int64 v8; 
  NTSTATUS v9; 
  EVENT_DESCRIPTOR *v10; 
  __int64 v11; 
  UNICODE_STRING *v13; 
  UINT64 v14; 
  const _GUID *v15; 
  PVOID Buffera; 
  UINT64 Length; 
  struct _IO_STATUS_BLOCK IoStatusBlock; 
  v2 = *((unsigned int *)LoggerContext + 77);
  BufferSize = Buffer->BufferSize;
  IoStatusBlock = 0i64;
  if( (_DWORD)v2 )
  {
    v6 = *((unsigned int *)LoggerContext + 55);
    v7 = *((_DWORD *)LoggerContext + 3);
    v8 = BufferSize * v6;
    if( v8 >= v2 * ((-(__int64)((v7 & 0x2000) != 0) & 0xFFFFFFFFFFF00400ui64) + 0x100000) )
    {
      if( (v7 & 2) != 0 )
      {
        *((_QWORD *)LoggerContext + 29) = *((unsigned int *)LoggerContext + 1);
        *((_DWORD *)LoggerContext + 55) = 1;
      }
      else
      {
        if( (v7 & 8) == 0 )
        {
          v9 = -1073741432;
          if( (*((_DWORD *)LoggerContext + 208) & 0x100) == 0 )
          {
            _InterlockedOr((volatile signed __int32 *)LoggerContext + 208, 0x100u);
            if( EtwEventEnabled(
                   EtwpEventTracingProvRegHandle,
                   (EVENT_DESCRIPTOR *)&ETW_EVENT_MAX_FILE_SIZE_REACHED,
                   (EVENT_DESCRIPTOR *)v8) )
            {
              EtwpEventWriteTemplateMaxFileSize(
                (UNICODE_STRING *)((char *)LoggerContext + 168),
                v13,
                v14,
                (UINT64)LoggerContext + 152,
                (GUID *)((char *)LoggerContext + 168));
            }
          }
          goto LABEL_16;
        }
        if( (*((_DWORD *)LoggerContext + 209) & 1) == 0 )
        {
          EtwpGenerateFileName(
            (_UNICODE_STRING *)((char *)LoggerContext + 184),
            (INT64 *)LoggerContext + 39,
            (_UNICODE_STRING *)((char *)LoggerContext + 200));
          _InterlockedOr((volatile signed __int32 *)LoggerContext + 209, 1u);
        }
      }
    }
  }
  v9 = ZwWriteFile(
         *((HANDLE *)LoggerContext + 102),
         0i64,
         0i64,
         0i64,
         &IoStatusBlock,
         Buffer,
         BufferSize,
         (PLARGE_INTEGER)LoggerContext + 29,
         0i64);
  if( v9 < 0 )
  {
    if( EtwEventEnabled(EtwpEventTracingProvRegHandle, (EVENT_DESCRIPTOR *)&ETW_EVENT_WRITE_FAILED, v10) )
    {
      LODWORD(Length) = *((_DWORD *)LoggerContext + 3);
      LODWORD(Buffera) = v9;
      EtwpEventWriteTemplateAdmin(
        (UINT64)LoggerContext + 168,
        &ETW_EVENT_WRITE_FAILED,
        v15,
        (const _UNICODE_STRING *)((char *)LoggerContext + 152),
        (const _UNICODE_STRING *)((char *)LoggerContext + 168),
        (const INT64)Buffera,
        Length);
    }
  }
  else
  {
    v11 = *((_QWORD *)LoggerContext + 135);
    *((_QWORD *)LoggerContext + 29) += BufferSize;
    _InterlockedExchangeAdd64((volatile signed __int64 *)(v11 + 4128), BufferSize);
  }
  if( v9 >= 0 )
  {
    ++*((_DWORD *)LoggerContext + 66);
    ++*((_DWORD *)LoggerContext + 55);
    return(unsigned int)v9;
  }
LABEL_16:
  _InterlockedIncrement((volatile signed __int32 *)LoggerContext + 67);
  if( v9 == -1073741670 )
    return 0;
  return(unsigned int)v9;
}

Referenced by: