EtwpRealtimeRestoreBuffer

NTSTATUS __stdcall EtwpRealtimeRestoreBuffer(_WMI_LOGGER_CONTEXT *LoggerContext, _WMI_BUFFER_HEADER *Buffer){
  _LARGE_INTEGER *ByteOffset; 
  LONGLONG QuadPart; 
  NTSTATUS result; 
  unsigned int BufferSize; 
  unsigned int v8; 
  bool v9; 
  __int64 Length; 
  __int64 v11; 
  _IO_STATUS_BLOCK IoStatusBlock; 

  ByteOffset = &LoggerContext->RealtimeReadOffset;
  QuadPart = LoggerContext->RealtimeReadOffset.QuadPart + 72;
  IoStatusBlock = 0i64;
  if( QuadPart > LoggerContext->RealtimeLogfileSize.QuadPart )
    return -1073741566;
  result = ZwReadFile(
             (_HANDLE)LoggerContext->RealtimeLogfileHandle,
             0,
             0i64,
             0i64,
             &IoStatusBlock,
             Buffer,
             0x48u,
             ByteOffset,
             0i64);
  if( result < 0 )
    return result;
  if( IoStatusBlock.Status < 0 )
    return IoStatusBlock.Status;
  if( IoStatusBlock.Information != 72 )
    return -1073741807;
  BufferSize = LoggerContext->BufferSize;
  if( *(_DWORD *)Buffer != BufferSize )
    return -1073741566;
  v8 = *((_DWORD *)Buffer + 12);
  if( v8 < 0x48 || v8 > BufferSize )
    return -1073741566;
  *((_WORD *)Buffer + 26) |= 0x10u;
  ByteOffset->QuadPart = QuadPart;
  v9 = v8 == 72;
  Length = v8 - 72;
  if( !v9 )
  {
    v11 = (unsigned int)Length;
    if( Length + QuadPart <= LoggerContext->RealtimeLogfileSize.QuadPart )
    {
      result = ZwReadFile(
                 (_HANDLE)LoggerContext->RealtimeLogfileHandle,
                 0,
                 0i64,
                 0i64,
                 &IoStatusBlock,
                 (char *)Buffer + 72,
                 Length,
                 ByteOffset,
                 0i64);
      if( result >= 0 )
      {
        result = IoStatusBlock.Status;
        if( IoStatusBlock.Status >= 0 && IoStatusBlock.Information != v11 )
          result = -1073741807;
      }
      ByteOffset->QuadPart += v11;
      QuadPart = ByteOffset->QuadPart;
      goto LABEL_15;
    }
    return -1073741566;
  }
LABEL_15:
  if( QuadPart >= LoggerContext->RealtimeLogfileSize.QuadPart )
    ByteOffset->QuadPart = 72i64;
  return result;
}

Referenced by: