EtwpAllocateTraceBuffer

CHAR *__stdcall EtwpAllocateTraceBuffer(INT64 a1, UINT64 a2){
  unsigned __int64 v3; 
  VOID **v4; 
  CHAR *v6; 
  _MDL *PagesForMdl; 
  UINT64 v8; 
  INT64 *CacheType; 
  UINT64 CacheTypea; 
  UINT64 Flags; 
  UINT64 Flagsa; 
  UINT64 Flags_8; 

  v3 = (unsigned int)a2;
  v4 = (VOID **)(a1 + 1304);
  if( *v4 )
    return(CHAR *)EtwpAllocatePartitionMemory(v4, (unsigned int)a2);
  if( (*(_DWORD *)(a1 + 832) & 0x20000000) == 0 )
    return(CHAR *)ExAllocatePoolWithTag(*(unsigned int *)(a1 + 316), (unsigned int)a2, 1115124805i64);
  v6 = 0i64;
  PagesForMdl = (_MDL *)MmAllocatePagesForMdlEx(
                          0i64,
                          (PHYSICAL_ADDRESS)-1i64,
                          (PHYSICAL_ADDRESS)0x200000i64,
                          a2,
                          MmCached,
                          0x65u);
  if( PagesForMdl
    || (PagesForMdl = (_MDL *)MmAllocatePagesForMdlEx(
                                0i64,
                                (PHYSICAL_ADDRESS)-1i64,
                                (PHYSICAL_ADDRESS)0x200000i64,
                                v3,
                                MmCached,
                                0x25u)) != 0i64 )
  {
    qsort((UINT64)&PagesForMdl[1], v3 >> 12, 8ui64, (INT64)EtwpComparePfn, CacheType, Flags, Flags_8);
    LODWORD(Flagsa) = 1073741856;
    LODWORD(CacheTypea) = 0;
    v6 = (CHAR *)MmMapLockedPagesSpecifyCache(PagesForMdl, 0, MmCached, 0i64, CacheTypea, Flagsa);
    if( v6 )
    {
      if( !*(_QWORD *)(a1 + 1312) )
      {
        *(_QWORD *)(a1 + 1312) = PagesForMdl;
        PagesForMdl = 0i64;
      }
    }
    else
    {
      MiFreePagesFromMdl(PagesForMdl, 0i64, v8);
    }
    if( PagesForMdl )
      ExFreePoolWithTag(PagesForMdl, 0);
  }
  return v6;
}

Referenced by: