EtwGetProcessorBuffer

NTSTATUS __stdcall EtwGetProcessorBuffer(UINT64 LoggerId, UINT64 ProcessorNumber, _ETW_BUFFER_INFORMATION *BufferInfo){
  NTSTATUS v3; 
  __int64 v6; 
  __int64 v7; 
  _ETW_BUFFER_INFORMATION *v8; 
  unsigned int v9; 

  v3 = 0;
  if( !*(&ExBootDevicesRemovedEvent + 1440) )
    return -1073741823;
  if( (unsigned int)LoggerId >= *(_DWORD *)(EtwpHostSiloState + 16) )
  {
    v6 = 1i64;
  }
  else
  {
    _mm_lfence();
    v6 = *(_QWORD *)(*(_QWORD *)(EtwpHostSiloState + 456) + 8i64 * (unsigned int)LoggerId);
  }
  if( (v6 & 1) != 0 )
    return -1073741816;
  if( *(_DWORD *)(v6 + 316) == 1 )
    return -1073741811;
  if( (*(_DWORD *)(v6 + 12) & 0x10000000) != 0 )
    v7 = *(_QWORD *)(v6 + 144);
  else
    v7 = *(_QWORD *)(*(_QWORD *)(*(_QWORD *)(*(_QWORD *)(v6 + 1080) + 4136i64)
                               + ((unsigned __int64)(unsigned int)ProcessorNumber << 6))
                   + 8i64 * (unsigned int)LoggerId);
  v8 = (_ETW_BUFFER_INFORMATION *)(v7 & 0xFFFFFFFFFFFFFFF0ui64);
  if( !v8 )
    return -1073741823;
  BufferInfo[2] = *v8;
  v9 = v8[2];
  *(_QWORD *)BufferInfo = v8;
  if( v9 <= *v8 )
    BufferInfo[3] = v8[2];
  else
    BufferInfo[3] = v8[1];
  return v3;
}

Referenced by: