EtwpFreeTraceBuffer

VOID __stdcall EtwpFreeTraceBuffer(INT64 a1, CHAR *a2){
  UINT64 v2; 
  CHAR *v3; 
  __int64 v4; 
  unsigned __int64 *v5; 
  unsigned int v6; 
  __int64 v7; 
  unsigned __int64 v8; 

  v3 = a2;
  if( *(_QWORD *)(a1 + 1304) )
  {
    EtwpFreePartitionMemory(a1, a2);
  }
  else if( (*(_DWORD *)(a1 + 832) & 0x20000000) != 0 )
  {
    v4 = *(_QWORD *)(a1 + 1312);
    *(_WORD *)(v4 + 10) |= 3u;
    v5 = (unsigned __int64 *)(v4 + 48);
    *(_QWORD *)(v4 + 24) = a2;
    v6 = *(_DWORD *)(a1 + 4) >> 12;
    if( v6 )
    {
      v7 = v6;
      do
      {
        LODWORD(v8) = MmGetPhysicalAddress((UINT64)v3);
        v3 += 4096;
        *v5++ = v8 >> 12;
        --v7;
      }
      while( v7 );
    }
    MiFreePagesFromMdl((PVOID)v4, 0i64, v2);
  }
  else
  {
    ExFreePoolWithTag(a2, 0);
  }
}

Referenced by: