EtwpReceiveReplyDataBlock

NTSTATUS __stdcall EtwpReceiveReplyDataBlock(VOID *Buffer, UINT64 BufferSize, UINT64 *ReturnSize){
  VOID *v5; 
  size_t v6; 
  _LARGE_INTEGER v7; 
  int v8; 
  _ADAPTER_OBJECT *v9; 
  _LIST_ENTRY *v10; 
  _LIST_ENTRY *v11; 
  _ETWP_NOTIFICATION_HEADER *Flink; 
  size_t NotificationSize; 
  PADAPTER_OBJECT DmaAdapter; 
  _LARGE_INTEGER Timeout; 

  *(_DWORD *)ReturnSize = 0;
  v5 = (VOID *)*(unsigned int *)Buffer;
  v6 = BufferSize;
  v7.QuadPart = EtwpOneMs * *((unsigned int *)Buffer + 1);
  DmaAdapter = 0i64;
  Timeout = v7;
  v8 = ObReferenceObjectByHandle(v5, 4ui64, EtwpRegistrationObjectType, 1, (VOID **)&DmaAdapter, 0i64);
  if( v8 >= 0 )
  {
    v9 = DmaAdapter;
    if( (DmaAdapter->AdapterObject.CrashDump.ContiguousHint.Offset & 0x40000) != 0 )
    {
      v10 = KeRemoveQueue((_KQUEUE *)DmaAdapter->AdapterObject.ScatterTranslations, 1, &Timeout);
      v11 = v10;
      if( v10 == (_LIST_ENTRY *)258 || v10 == (_LIST_ENTRY *)192 )
      {
        v8 = (int)v10;
      }
      else
      {
        Flink = (_ETWP_NOTIFICATION_HEADER *)v10[1].Flink;
        NotificationSize = Flink->NotificationSize;
        if( NotificationSize > v6 )
        {
          v8 = -1073741789;
        }
        else
        {
          memmove(Buffer, Flink, NotificationSize);
          NotificationSize = Flink->NotificationSize;
          v8 = 0;
        }
        *(_DWORD *)ReturnSize = NotificationSize;
        EtwpUnreferenceDataBlock(Flink);
        ExFreePoolWithTag(v11, 0);
      }
    }
    else
    {
      v8 = -1073741816;
    }
    HalPutDmaAdapter(v9);
  }
  return v8;
}

Referenced by: