EtwpPreserveLogger

NTSTATUS __stdcall EtwpPreserveLogger(_WMI_LOGGER_CONTEXT *LoggerContext){
  struct _ETW_SOFT_RESTART_CONTEXT *SoftRestartContext; 
  __int64 BufferSize; 
  VOID **PoolWithTag; 
  VOID **v6; 
  NTSTATUS v7; 
  _WMI_BUFFER_HEADER *TraceBuffer; 
  _WMI_BUFFER_HEADER *v9; 
  _UNICODE_STRING LogFileName; 
  _LIST_ENTRY *Flink; 
  char *p_Blink; 
  _WMI_LOGGER_CONTEXT *v13; 
  _UNICODE_STRING Src; 

  SoftRestartContext = LoggerContext->SoftRestartContext;
  if( *((_BYTE *)SoftRestartContext + 33) )
    return 0;
  BufferSize = LoggerContext->BufferSize;
  Src = (_UNICODE_STRING)*((_OWORD *)SoftRestartContext + 1);
  if( ((BufferSize * (unsigned int)(LoggerContext->NumberOfBuffers + 1)) & 0xFFFFFFFFFFFFF000ui64) > 0xFFFFFFFF000i64 )
    return -1073741637;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, (unsigned int)Src.Length + 18, 1266119749i64);
  v6 = PoolWithTag;
  if( PoolWithTag )
  {
    memset(PoolWithTag, 0i64, Src.Length + 18);
    *((_DWORD *)v6 + 2) = LoggerContext->BufferSize;
    *((_DWORD *)v6 + 3) = 16;
    memmove(v6 + 2, Src.Buffer, Src.Length + 2);
    TraceBuffer = (_WMI_BUFFER_HEADER *)EtwpAllocateTraceBuffer((INT64)LoggerContext, (unsigned int)BufferSize);
    v9 = TraceBuffer;
    if( !TraceBuffer )
    {
      v7 = -1073741801;
LABEL_20:
      ExFreePoolWithTag(v6, 0);
      return v7;
    }
    EtwpInitializeBufferHeader(LoggerContext, TraceBuffer);
    EtwpResetBufferHeader(v9, 4u);
    LogFileName = LoggerContext->LogFileName;
    LoggerContext->LogFileName = Src;
    EtwpAddLogHeader(LoggerContext, v9);
    LoggerContext->LogFileName = LogFileName;
    v7 = EtwpBuildMdlForTraceBuffer((_WMI_BUFFER_HEADER *)LoggerContext, (_MDL **)v9);
    if( v7 >= 0 )
    {
      ++*((_DWORD *)v6 + 1);
      Flink = LoggerContext->GlobalList.Flink;
      p_Blink = (char *)&Flink[-4].Blink;
      if( Flink == &LoggerContext->GlobalList )
        p_Blink = 0i64;
      if( p_Blink )
      {
        while( 1 )
        {
          v7 = EtwpBuildMdlForTraceBuffer((_WMI_BUFFER_HEADER *)LoggerContext, (_MDL **)p_Blink);
          if( v7 < 0 )
            break;
          MEMORY[0] = 0i64;
          ++*((_DWORD *)v6 + 1);
          v13 = (_WMI_LOGGER_CONTEXT *)*((_QWORD *)p_Blink + 7);
          p_Blink = (char *)&v13[-1].CallbackContext;
          if( v13 == (_WMI_LOGGER_CONTEXT *)&LoggerContext->GlobalList )
            p_Blink = 0i64;
          if( !p_Blink )
            goto LABEL_17;
        }
      }
      else
      {
LABEL_17:
        v7 = EtwpPreserveMdlList(0i64, (__int64)v6, (unsigned int)Src.Length + 18, (__int64)SoftRestartContext);
        if( v7 >= 0 )
        {
          *((_QWORD *)SoftRestartContext + 1) = v9;
          *((_BYTE *)SoftRestartContext + 33) = 1;
          goto LABEL_20;
        }
      }
    }
    EtwpFreeTraceBuffer((INT64)LoggerContext, (CHAR *)v9);
    goto LABEL_20;
  }
  return -1073741670;
}

Referenced by: