EtwpFindUserBufferSpace

NTSTATUS __stdcall EtwpFindUserBufferSpace(
        _WMI_LOGGER_CONTEXT *Prc,
        _ETW_REALTIME_CONSUMER *BufferSize,
        _WMI_BUFFER_HEADER **UserBuffer,
        _WMI_BUFFER_HEADER **a4){
  NTSTATUS v6; 
  unsigned int v7; 
  unsigned int NextAlignedForwardRunClear; 
  unsigned int v9; 
  NTSTATUS v11; 
  UINT64 AllocationType; 
  UINT64 Protect; 
  UINT64 RegionSize; 

  v6 = 0;
  *a4 = 0i64;
  RegionSize = ((_DWORD)UserBuffer + 4095) & 0xFFFFF000;
  v7 = (unsigned int)RegionSize >> 12;
  NextAlignedForwardRunClear = RtlFindNextAlignedForwardRunClear(
                                 &BufferSize->ReservedBufferSpaceBitMap,
                                 (UINT64)BufferSize,
                                 (unsigned int)RegionSize >> 12,
                                 (UINT64)a4);
  v9 = NextAlignedForwardRunClear;
  if( NextAlignedForwardRunClear != -1
    && RtlInterlockedSetClearRun((INT64)&BufferSize->ReservedBufferSpaceBitMap, NextAlignedForwardRunClear, v7) )
  {
    *a4 = (_WMI_BUFFER_HEADER *)&BufferSize->ReservedBufferSpace[4096 * v9];
  }
  BufferSize->UserPagesReused += v7;
  if( !*a4 )
  {
    LODWORD(Protect) = 4;
    LODWORD(AllocationType) = 4096;
    v11 = ZwAllocateVirtualMemory(BufferSize->ProcessHandle, (VOID **)a4, 0i64, &RegionSize, AllocationType, Protect);
    v6 = v11;
    if( v11 < 0 )
    {
      if( v11 == -1073741670 || v11 == -1073741523 )
        return -1073741764;
    }
    else
    {
      BufferSize->UserPagesAllocated += v7;
    }
  }
  return v6;
}

Referenced by: