EtwpAddBinaryInfoEvents

NTSTATUS __stdcall EtwpAddBinaryInfoEvents(
        _WMI_LOGGER_CONTEXT *LoggerContext,
        _WMI_BUFFER_HEADER *Buffer,
        UINT64 BufferSize){
  char v3; 
  int v4; 
  int v5; 
  char v6; 
  _WMI_LOGGER_CONTEXT *Flink; 
  _WMI_BUFFER_HEADER *v9; 
  int v10; 
  unsigned int v11; 
  unsigned int *v12; 
  UINT64 DataSize; 
  UINT64 RemainingBufferSize; 
  _WMI_BUFFER_HEADER *Bufferb; 
  UINT64 EventSize; 
  int v19; 

  LODWORD(EventSize) = 0;
  v4 = BufferSize - *((_DWORD *)Buffer + 12);
  v5 = v3 & 2;
  v6 = v3;
  v19 = v5;
  if( (v3 & 2) != 0 )
    ExAcquirePushLockExclusiveEx(&LoggerContext->LoggerLock, 0i64);
  Flink = (_WMI_LOGGER_CONTEXT *)LoggerContext->BinaryTrackingList.Flink;
  if( Flink != (_WMI_LOGGER_CONTEXT *)&LoggerContext->BinaryTrackingList )
  {
    v9 = Buffer;
    v10 = v6 & 4;
    do
    {
      if( v10 )
        v11 = Flink->EventMarker[1];
      else
        v11 = Flink->EventMarker[0];
      if( v11 )
      {
        LODWORD(RemainingBufferSize) = v4;
        LODWORD(DataSize) = 16 * v11 + 4 + Flink->AcceptNewEvents;
        LODWORD(v12) = EtwpAddEventToBuffer(
                         v9,
                         0x43u,
                         (_LARGE_INTEGER *)v9 + 11,
                         0i64,
                         DataSize,
                         RemainingBufferSize,
                         &EventSize);
        if( !v12 )
          break;
        *v12 = v11;
        Bufferb = (_WMI_BUFFER_HEADER *)(v12 + 1);
        memmove(v12 + 1, &Flink->EventMarker[4 * (Flink->EventMarker[0] - v11) + 2], 16 * v11);
        memmove((char *)Bufferb + 16 * v11, &Flink->EventMarker[4 * Flink->EventMarker[0] + 2], Flink->AcceptNewEvents);
        if( v10 )
          Flink->EventMarker[1] = 0;
        v4 -= EventSize;
      }
      Flink = *(_WMI_LOGGER_CONTEXT **)&Flink->LoggerId;
    }
    while( Flink != (_WMI_LOGGER_CONTEXT *)&LoggerContext->BinaryTrackingList );
    v5 = v19;
  }
  if( v5 )
  {
    if( (_InterlockedExchangeAdd64(&LoggerContext->LoggerLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(&LoggerContext->LoggerLock);
    KeAbPostRelease(&LoggerContext->LoggerLock);
  }
  return 0;
}

Referenced by: