EtwpFlushBufferToLogfile

NTSTATUS __stdcall EtwpFlushBufferToLogfile(_WMI_LOGGER_CONTEXT *LoggerContext, _WMI_BUFFER_HEADER *Buffer){
  __int64 MaximumFileSize; 
  unsigned __int64 Length; 
  __int64 LastFlushedBuffer; 
  unsigned int LoggerMode; 
  int v8; 
  _ETW_SILODRIVERSTATE *SiloState; 
  _UNICODE_STRING *v11; 
  UINT64 v12; 
  __int64 v13; 
  _IO_STATUS_BLOCK IoStatusBlock; 

  MaximumFileSize = LoggerContext->MaximumFileSize;
  Length = *(_DWORD *)Buffer;
  IoStatusBlock = 0i64;
  if( (_DWORD)MaximumFileSize )
  {
    LastFlushedBuffer = LoggerContext->LastFlushedBuffer;
    LoggerMode = LoggerContext->LoggerMode;
    if( Length * LastFlushedBuffer >= MaximumFileSize
                                     * ((-(__int64)((LoggerMode & 0x2000) != 0) & 0xFFFFFFFFFFF00400ui64) + 0x100000) )
    {
      if( (LoggerMode & 2) != 0 )
      {
        LoggerContext->ByteOffset.QuadPart = LoggerContext->BufferSize;
        LoggerContext->LastFlushedBuffer = 1;
      }
      else
      {
        if( (LoggerMode & 8) == 0 )
        {
          v8 = -1073741432;
          if( (LoggerContext->Flags & 0x100) == 0 )
          {
            _InterlockedOr((volatile signed __int32 *)&LoggerContext->832, 0x100u);
            if( EtwEventEnabled(*(&ExBootDevicesRemovedEvent + 241), &ETW_EVENT_MAX_FILE_SIZE_REACHED) )
              EtwpEventWriteTemplateMaxFileSize(
                &LoggerContext->LogFileName,
                v11,
                v12,
                (UINT64)&LoggerContext->LoggerName,
                (_GUID *)&LoggerContext->LogFileName);
          }
          goto LABEL_16;
        }
        if( (LoggerContext->$9091B98C86B9D902DEA615B340B1CB3F::_bf_0 & 1) == 0 )
        {
          EtwpGenerateFileName(
            &LoggerContext->LogFilePattern,
            (INT64 *)&LoggerContext->FileCounter,
            &LoggerContext->NewLogFileName);
          _InterlockedOr((volatile signed __int32 *)&LoggerContext->836, 1u);
        }
      }
    }
  }
  v8 = ZwWriteFile(
         (_HANDLE)LoggerContext->LogFileHandle,
         0,
         0i64,
         0i64,
         &IoStatusBlock,
         Buffer,
         Length,
         &LoggerContext->ByteOffset,
         0i64);
  if( v8 < 0 )
  {
    if( EtwEventEnabled(*(&ExBootDevicesRemovedEvent + 241), &ETW_EVENT_WRITE_FAILED) )
      EtwpEventWriteTemplateAdmin(
        (__int64)&LoggerContext->LogFileName,
        &ETW_EVENT_WRITE_FAILED,
        v13,
        &LoggerContext->LoggerName.Length,
        &LoggerContext->LogFileName.Length,
        v8,
        LoggerContext->LoggerMode);
  }
  else
  {
    SiloState = LoggerContext->SiloState;
    LoggerContext->ByteOffset.QuadPart += Length;
    _InterlockedExchangeAdd64((volatile signed __int64 *)&SiloState->LogfileBytesWritten, Length);
  }
  if( v8 >= 0 )
  {
    ++LoggerContext->BuffersWritten;
    ++LoggerContext->LastFlushedBuffer;
    return v8;
  }
LABEL_16:
  _InterlockedIncrement((volatile signed __int32 *)&LoggerContext->LogBuffersLost);
  if( v8 == -1073741670 )
    return 0;
  return v8;
}

Referenced by: