EtwpCompressBuffer

NTSTATUS __stdcall EtwpCompressBuffer(_WMI_LOGGER_CONTEXT *LoggerContext, _WMI_BUFFER_HEADER *UncompressedBuffer){
  unsigned int v4; 
  unsigned int v5; 
  unsigned int v6; 
  int v7; 
  __int64 v8; 
  _WMI_BUFFER_HEADER *v9; 
  __int64 v10; 
  unsigned int v11; 
  unsigned int v12; 
  unsigned int i; 
  int v14; 
  int NextEventOffsetType; 
  int v16; 
  _WMI_BUFFER_HEADER *CompressionTarget; 
  int v19; 
  UINT64 CompressedBufferSize; 
  UINT64 v21; 
  UINT64 FinalCompressedSize; 
  UINT64 EventSize; 
  unsigned int v24; 

  LODWORD(FinalCompressedSize) = 0;
  LODWORD(EventSize) = 0;
  if( *((_DWORD *)UncompressedBuffer + 2) <= *(_DWORD *)UncompressedBuffer )
    v4 = *((_DWORD *)UncompressedBuffer + 2);
  else
    v4 = *((_DWORD *)UncompressedBuffer + 1);
  v5 = v4 - 72;
  v6 = 72;
  if( v4 == 72 )
    return 0;
  EtwpRotateCompressionTargetIfNeeded(LoggerContext);
  while( 1 )
  {
    CompressionTarget = LoggerContext->CompressionTarget;
    if( !CompressionTarget )
    {
      ++LoggerContext->LogBuffersLost;
      return -1073741801;
    }
    v8 = *((unsigned int *)CompressionTarget + 2);
    v9 = LoggerContext->CompressionTarget;
    v10 = (unsigned int)v8;
    if( *((_DWORD *)v9 + 2) == 72
      || v5 < (LoggerContext->BufferSize - *((_DWORD *)v9 + 2) - 72) * LoggerContext->CompressionRatioGuess )
    {
      LODWORD(v21) = 0;
      LODWORD(CompressedBufferSize) = LoggerContext->BufferSize - *((_DWORD *)v9 + 2) - 72;
      v7 = RtlCompressBuffer(
             3u,
             (UINT8 *)UncompressedBuffer + v6,
             v5,
             (UINT8 *)v9 + v8 + 72,
             CompressedBufferSize,
             v21,
             &FinalCompressedSize,
             LoggerContext->CompressionWorkspace);
      if( v7 >= 0 )
      {
        *(_OWORD *)((char *)v9 + v10) = *(_OWORD *)UncompressedBuffer;
        *(_OWORD *)((char *)v9 + v10 + 16) = *((_OWORD *)UncompressedBuffer + 1);
        *(_OWORD *)((char *)v9 + v10 + 32) = *((_OWORD *)UncompressedBuffer + 2);
        *(_OWORD *)((char *)v9 + v10 + 48) = *((_OWORD *)UncompressedBuffer + 3);
        *(_QWORD *)((char *)v9 + v10 + 64) = *((_QWORD *)UncompressedBuffer + 8);
        v19 = FinalCompressedSize;
        *(_QWORD *)((char *)v9 + v10 + 24) = 0i64;
        *(_DWORD *)((char *)v9 + v10) = v19 + 72;
        *(_DWORD *)((char *)v9 + v10 + 8) = v5 + 72;
        *(_DWORD *)((char *)v9 + v10 + 4) = v5 + 72;
        *(_DWORD *)((char *)v9 + v10 + 12) = 0;
        *(_DWORD *)((char *)v9 + v10 + 44) = 3;
        *((_DWORD *)LoggerContext->CompressionTarget + 2) += 72;
        *((_DWORD *)LoggerContext->CompressionTarget + 2) += FinalCompressedSize;
        return v7;
      }
    }
    LOBYTE(v11) = 1;
    v24 = 1;
    if( LoggerContext->PartialBufferCompressionLevel )
      break;
LABEL_26:
    v5 = v4 - v6;
    EtwpRotateCompressionTarget(LoggerContext);
  }
  while( 1 )
  {
    v12 = v6 + (v5 >> v11);
    for( i = 0; ; i += EventSize )
    {
      NextEventOffsetType = EtwpGetNextEventOffsetType(UncompressedBuffer, v6 + i, &EventSize);
      if( !NextEventOffsetType || (unsigned int)EventSize + v6 + i > v12 )
        break;
    }
    if( i )
    {
      LODWORD(v21) = 0;
      LODWORD(CompressedBufferSize) = v14;
      if( RtlCompressBuffer(
             3u,
             (UINT8 *)UncompressedBuffer + v6,
             i,
             (UINT8 *)v9 + v10 + 72,
             CompressedBufferSize,
             v21,
             &FinalCompressedSize,
             LoggerContext->CompressionWorkspace) >= 0 )
      {
        v6 += i;
        *(_OWORD *)((char *)v9 + v10) = *(_OWORD *)UncompressedBuffer;
        *(_OWORD *)((char *)v9 + v10 + 16) = *((_OWORD *)UncompressedBuffer + 1);
        *(_OWORD *)((char *)v9 + v10 + 32) = *((_OWORD *)UncompressedBuffer + 2);
        *(_OWORD *)((char *)v9 + v10 + 48) = *((_OWORD *)UncompressedBuffer + 3);
        *(_QWORD *)((char *)v9 + v10 + 64) = *((_QWORD *)UncompressedBuffer + 8);
        v16 = FinalCompressedSize;
        *(_QWORD *)((char *)v9 + v10 + 24) = 0i64;
        *(_DWORD *)((char *)v9 + v10) = v16 + 72;
        *(_DWORD *)((char *)v9 + v10 + 8) = i + 72;
        *(_DWORD *)((char *)v9 + v10 + 4) = i + 72;
        *(_DWORD *)((char *)v9 + v10 + 12) = 0;
        *(_DWORD *)((char *)v9 + v10 + 44) = 3;
        *((_DWORD *)LoggerContext->CompressionTarget + 2) += 72;
        *((_DWORD *)LoggerContext->CompressionTarget + 2) += FinalCompressedSize;
        goto LABEL_26;
      }
      v11 = ++v24;
      goto LABEL_23;
    }
    if( *((_DWORD *)LoggerContext->CompressionTarget + 2) != 72 )
      goto LABEL_26;
    if( !NextEventOffsetType )
      break;
    EtwpUpdateEventsLostCount(LoggerContext);
    v6 += EventSize;
    if( v6 == v4 )
      return 0;
    if( v6 > v4 )
      return -1073741566;
    v11 = v24;
LABEL_23:
    v5 = v4 - v6;
    if( v11 > LoggerContext->PartialBufferCompressionLevel )
      goto LABEL_26;
  }
  ++LoggerContext->LogBuffersLost;
  return -1073741566;
}

Referenced by: