EtwpSavePersistedLoggersWorker

VOID __stdcall EtwpSavePersistedLoggersWorker(VOID *Context){
  VOID **PoolWithTag; 
  __int64 v2; 
  VOID **v3; 
  int v4; 
  __int64 i; 
  int v6; 
  WCHAR v7; 
  int v8; 

  v8 = 0;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, 8i64 * *(unsigned int *)(EtwpHostSiloState + 16) + 4112, 1266119749i64);
  v3 = PoolWithTag;
  if( !PoolWithTag )
    goto LABEL_9;
  *(_DWORD *)PoolWithTag = 0;
  PoolWithTag[1] = PoolWithTag + 514;
  v4 = KsrEnumeratePersistedMemory(EtwpKsrGuid, EtwpKsrMemoryEnumCallback, PoolWithTag);
  if( v4 >= 0 )
  {
    for( i = 0i64; (unsigned int)i < *(_DWORD *)v3; i = (unsigned int)(i + 1) )
    {
      v6 = KsrQueryMetadata(EtwpKsrGuid, *((_QWORD *)v3[1] + i), v3 + 2, 4096i64, &v8);
      if( v6 >= 0 )
        EtwpSavePersistedLogger((__int64)(v3 + 2), *((_QWORD *)v3[1] + i), v7);
      else
        v4 = v6;
    }
  }
  ExFreePoolWithTag(v3, 0);
  if( v4 < 0 )
  {
LABEL_9:
    LOBYTE(v2) = 1;
    KsrFreePersistedMemory(EtwpKsrGuid, v2);
  }
  _InterlockedExchange(&EtwpLoggerSaveState, 2);
}

Referenced by: