EtwpRealtimeRestoreState

NTSTATUS __stdcall EtwpRealtimeRestoreState(_WMI_LOGGER_CONTEXT *LoggerContext){
  NTSTATUS result; 
  void *RealtimeLogfileHandle; 
  int UsedProcessorCount; 
  unsigned __int64 RealtimeMaximumFileSize; 
  void *v6; 
  __int64 v7; 
  unsigned __int64 v8; 
  _ETW_REF_CLOCK v9; 
  unsigned __int64 v10; 
  __int64 v11; 
  __int64 v12; 
  __int64 v13; 
  int FileInformationClass; 
  _LARGE_INTEGER ByteOffset; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  __int128 Buffer[5]; 
  __int128 FileInformation; 
  __int64 v19; 

  v19 = 0i64;
  FileInformation = 0i64;
  IoStatusBlock = 0i64;
  memset(Buffer, 0i64, 0x48u);
  result = ZwQueryInformationFile(
             LoggerContext->RealtimeLogfileHandle,
             &IoStatusBlock,
             &FileInformation,
             0x18ui64,
             FileStandardInformation);
  if( result >= 0 )
  {
    if( !*((_QWORD *)&FileInformation + 1) )
      return 0;
    if( *((__int64 *)&FileInformation + 1) < 72 )
      return -1073741566;
    RealtimeLogfileHandle = LoggerContext->RealtimeLogfileHandle;
    ByteOffset.QuadPart = 0i64;
    result = ZwReadFile((_HANDLE)RealtimeLogfileHandle, 0, 0i64, 0i64, &IoStatusBlock, Buffer, 0x48u, &ByteOffset, 0i64);
    if( result < 0 )
      return result;
    result = IoStatusBlock.Status;
    if( IoStatusBlock.Status < 0 )
      return result;
    if( IoStatusBlock.Information != 72 )
      return -1073741807;
    if( LODWORD(Buffer[0]) != 1933995090 )
      return -1073741566;
    if( DWORD2(Buffer[0]) != 1 )
      return -1073741566;
    UsedProcessorCount = EtwpQueryUsedProcessorCount(LoggerContext);
    if( HIDWORD(Buffer[0]) != UsedProcessorCount )
      return -1073741566;
    if( !LODWORD(Buffer[2]) )
      return -1073741566;
    if( *((__int64 *)&Buffer[2] + 1) > *((__int64 *)&Buffer[3] + 1) )
      return -1073741566;
    if( *(__int64 *)&Buffer[3] > *((__int64 *)&Buffer[3] + 1) )
      return -1073741566;
    if( *(_QWORD *)&Buffer[3] == *((_QWORD *)&Buffer[2] + 1) )
      return -1073741566;
    if( *((_QWORD *)&Buffer[3] + 1) < 0x48ui64 )
      return -1073741566;
    RealtimeMaximumFileSize = LoggerContext->RealtimeMaximumFileSize;
    if( *((__int64 *)&Buffer[3] + 1) > (__int64)RealtimeMaximumFileSize
      || *(_QWORD *)&Buffer[4] > RealtimeMaximumFileSize
      || *((__int64 *)&FileInformation + 1) < *((__int64 *)&Buffer[3] + 1) )
    {
      return -1073741566;
    }
    v6 = LoggerContext->RealtimeLogfileHandle;
    LODWORD(Buffer[0]) = 0;
    result = ZwWriteFile((_HANDLE)v6, 0, 0i64, 0i64, &IoStatusBlock, Buffer, 0x48u, &ByteOffset, 0i64);
    if( result >= 0 )
    {
      v7 = *(_QWORD *)&Buffer[4];
      v8 = LoggerContext->BufferSize * LoggerContext->MaximumBuffers;
      v9 = (_ETW_REF_CLOCK)Buffer[1];
      LoggerContext->RealtimeBuffersSaved = Buffer[2];
      LoggerContext->RealtimeReadOffset.QuadPart = *((_QWORD *)&Buffer[2] + 1);
      LoggerContext->RealtimeWriteOffset.QuadPart = *(_QWORD *)&Buffer[3];
      LoggerContext->RealtimeLogfileSize.QuadPart = *((_QWORD *)&Buffer[3] + 1);
      v10 = LoggerContext->RealtimeMaximumFileSize - v7;
      LoggerContext->RealtimeLogfileUsage = v7;
      LoggerContext->RealtimeReferenceTime = v9;
      if( v10 <= v8 && LoggerContext->AcceptNewEvents >= 0 )
      {
        _InterlockedExchange(&LoggerContext->AcceptNewEvents, -1073741432);
        if( EtwEventEnabled(*(&ExBootDevicesRemovedEvent + 241), &ETW_EVENT_BACKING_FILE_FULL) )
          EtwpEventWriteTemplateBackingFile(
            v12,
            v11,
            v13,
            &LoggerContext->LoggerName.Length,
            FileInformationClass,
            LoggerContext->LoggerMode);
      }
      return 0;
    }
  }
  return result;
}

Referenced by: