EtwpPrepareDirtyBuffer

VOID __stdcall EtwpPrepareDirtyBuffer(VOID *LoggerContext, _WMI_BUFFER_HEADER *Buffer){
  int v2; 

  v2 = *((_DWORD *)LoggerContext + 3);
  if( (v2 & 0x400) != 0 )
  {
    if( (v2 & 0x4000000) != 0 )
    {
      EtwpEnqueueAvailableBuffer((_WMI_LOGGER_CONTEXT *)LoggerContext, Buffer, EtwBufferStatePendingCompression);
      if( !*((_DWORD *)LoggerContext + 288)
        && *((_QWORD *)LoggerContext + 156) >= 2i64 * *((_QWORD *)LoggerContext + 157) )
      {
        EtwpReenableCompression((_WMI_LOGGER_CONTEXT *)LoggerContext);
      }
      if( *((_DWORD *)LoggerContext + 288) && !_InterlockedExchange((volatile __int32 *)LoggerContext + 280, 2) )
      {
        if( ObGetCurrentIrql() > 2u )
          KeInsertQueueDpc((UINT64)LoggerContext + 1176, 0i64, 0i64);
        else
          EtwpCompressionDpc(0i64, LoggerContext, 0i64, 0i64);
      }
    }
    else
    {
      EtwpEnqueueAvailableBuffer((_WMI_LOGGER_CONTEXT *)LoggerContext, Buffer, EtwBufferStateFree);
    }
  }
  else
  {
    *((_DWORD *)Buffer + 11) = 3;
    *((_LARGE_INTEGER *)Buffer + 2) = EtwpGetLoggerTimeStamp((INT64)LoggerContext);
  }
}

Referenced by: