EtwpRealtimeSaveState

NTSTATUS __stdcall EtwpRealtimeSaveState(_WMI_LOGGER_CONTEXT *LoggerContext){
  int v2; 
  void *v3; 
  unsigned int RealtimeBuffersSaved; 
  _ETW_REF_CLOCK RealtimeReferenceTime; 
  unsigned __int64 RealtimeLogfileUsage; 
  int UsedProcessorCount; 
  void *RealtimeLogfileHandle; 
  UINT64 FileInformationClass; 
  char FileInformation[8]; 
  _LARGE_INTEGER ByteOffset; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  __int128 Buffer[5]; 

  v2 = -1073741823;
  IoStatusBlock = 0i64;
  memset(Buffer, 0i64, 0x48u);
  ByteOffset.QuadPart = 0i64;
  if( (LoggerContext->Flags & 1) == 0 )
    goto LABEL_2;
  if( !LoggerContext->RealtimeLogfileHandle )
    goto LABEL_7;
  RealtimeBuffersSaved = LoggerContext->RealtimeBuffersSaved;
  if( !RealtimeBuffersSaved )
    goto LABEL_7;
  RealtimeReferenceTime = LoggerContext->RealtimeReferenceTime;
  *((_QWORD *)&Buffer[2] + 1) = LoggerContext->RealtimeReadOffset.QuadPart;
  *(_QWORD *)&Buffer[3] = LoggerContext->RealtimeWriteOffset.QuadPart;
  DWORD1(Buffer[2]) = LoggerContext->BufferSize;
  *((_QWORD *)&Buffer[3] + 1) = LoggerContext->RealtimeLogfileSize.QuadPart;
  RealtimeLogfileUsage = LoggerContext->RealtimeLogfileUsage;
  LODWORD(Buffer[2]) = RealtimeBuffersSaved;
  *(_QWORD *)&Buffer[4] = RealtimeLogfileUsage;
  Buffer[1] = (__int128)RealtimeReferenceTime;
  LODWORD(Buffer[0]) = 1933995090;
  DWORD2(Buffer[0]) = 1;
  UsedProcessorCount = EtwpQueryUsedProcessorCount(LoggerContext);
  RealtimeLogfileHandle = LoggerContext->RealtimeLogfileHandle;
  DWORD1(Buffer[0]) = 0;
  HIDWORD(Buffer[0]) = UsedProcessorCount;
  v2 = ZwWriteFile((_HANDLE)RealtimeLogfileHandle, 0, 0i64, 0i64, &IoStatusBlock, Buffer, 0x48u, &ByteOffset, 0i64);
  if( v2 < 0 )
  {
LABEL_7:
    LoggerContext->RealTimeBuffersLost += LoggerContext->RealtimeBuffersSaved;
    LoggerContext->RealtimeBuffersSaved = 0;
    LoggerContext->RealtimeLogfileUsage = 0i64;
LABEL_2:
    v3 = LoggerContext->RealtimeLogfileHandle;
    FileInformation[0] = 1;
    LODWORD(FileInformationClass) = 13;
    ZwSetInformationFile((UINT64)v3, (UINT64)&IoStatusBlock, FileInformation, 1ui64, FileInformationClass);
  }
  return v2;
}

Referenced by: