EtwpBufferingModeFlush
NTSTATUS __stdcall EtwpBufferingModeFlush(_WMI_LOGGER_CONTEXT *LoggerContext){
unsigned int BufferSize;
int LogFile;
__int64 LoggerId;
__int64 UsedProcessorCount;
__int64 v6;
$B90001D19DE6081274E09A4BBDE43C18 *v7;
unsigned __int64 v8;
unsigned __int32 v9;
signed __int64 i;
signed __int64 v11;
signed __int64 v12;
__int64 v13;
_LIST_ENTRY *p_GlobalList;
__int64 v15;
__int64 p_Blink;
__int64 v17;
_LIST_ENTRY *v18;
signed __int32 v19;
signed __int32 v20;
_WMI_BUFFER_HEADER *v21;
unsigned __int64 v22;
__int64 v23;
char *j;
_WMI_BUFFER_HEADER *v25;
void *LogFileHandle;
unsigned int v28;
signed __int64 v29;
unsigned int v30;
__int64 v31;
signed __int64 QuadPart;
signed __int64 v33;
signed __int64 v34;
_WMI_BUFFER_HEADER *v35;
_WMI_BUFFER_HEADER *v36;
_LIST_ENTRY *k;
__int64 v38;
signed __int64 v39;
signed __int64 v40;
_LIST_ENTRY **v41;
BufferSize = LoggerContext->BufferSize;
LogFile = 0;
LoggerId = LoggerContext->LoggerId;
UsedProcessorCount = (unsigned int)EtwpQueryUsedProcessorCount(LoggerContext);
if( EtwpFileSystemReady )
_InterlockedOr((volatile signed __int32 *)&LoggerContext->832, 4u);
if( !LoggerContext->NewLogFileName.Buffer )
return LogFile;
LogFile = EtwpCreateLogFile(LoggerContext, 0);
if( LogFile < 0 )
{
LABEL_57:
LogFileHandle = LoggerContext->LogFileHandle;
if( LogFileHandle )
{
ZwClose((_HANDLE)LogFileHandle);
LoggerContext->LogFileHandle = 0i64;
}
RtlFreeAnsiString(&LoggerContext->LogFileName);
return LogFile;
}
if( (_DWORD)UsedProcessorCount )
{
v6 = 0i64;
do
{
if( (LoggerContext->LoggerMode & 0x10000000) != 0 )
v7 = &LoggerContext->144;
else
v7 = ($B90001D19DE6081274E09A4BBDE43C18 *)&LoggerContext->SiloState->ProcessorBlocks[v6].ProcessorBuffers[LoggerId];
v8 = v7->CurrentBuffer.Value & 0xFFFFFFFFFFFFFFF0ui64;
if( v8 )
{
v9 = _InterlockedExchangeAdd((volatile signed __int32 *)(v8 + 8), BufferSize);
if( v9 <= BufferSize )
*(_DWORD *)(v8 + 4) = v9;
_m_prefetchw(v7);
for( i = v7->CurrentBuffer.Value; (v8 ^ i) <= 0xF; i = v11 )
{
v11 = _InterlockedCompareExchange64((volatile signed __int64 *)v7, 0i64, i);
if( i == v11 )
break;
}
if( (i & 0xFFFFFFFFFFFFFFF0ui64) == v8 )
{
_InterlockedExchangeAdd((volatile signed __int32 *)((i & 0xFFFFFFFFFFFFFFF0ui64) + 12), -(i & 0xF));
EtwpPrepareDirtyBuffer(LoggerContext, (_WMI_BUFFER_HEADER *)v8);
}
}
++v6;
--UsedProcessorCount;
}
while( UsedProcessorCount );
}
EtwpLockUnlockBufferList(LoggerContext);
if( (LoggerContext->LoggerMode & 0x4000000) != 0 )
{
EtwpBufferingModeCompressionFlush(LoggerContext);
v13 = LoggerContext->BufferSequenceNumber + 1;
if( v13 >= 0 )
{
p_GlobalList = &LoggerContext->GlobalList;
LOBYTE(v12) = 3;
while( 1 )
{
--v13;
v15 = 0i64;
p_Blink = (__int64)&p_GlobalList->Flink[-4].Blink;
if( p_GlobalList->Flink == p_GlobalList )
p_Blink = 0i64;
if( !p_Blink )
goto LABEL_56;
while( 1 )
{
v17 = *(_QWORD *)(p_Blink + 24);
if( v17 == v13 )
break;
if( v17 < v13 && (!v15 || v17 > *(_QWORD *)(v15 + 24)) )
v15 = p_Blink;
v18 = *(_LIST_ENTRY **)(p_Blink + 56);
p_Blink = (__int64)&v18[-4].Blink;
if( v18 == p_GlobalList )
p_Blink = 0i64;
if( !p_Blink )
goto LABEL_36;
}
v15 = p_Blink;
LABEL_36:
if( !v15 )
goto LABEL_56;
v19 = *(_DWORD *)(v15 + 44);
if( (unsigned int)(v19 - 4) <= 1 )
{
v20 = _InterlockedCompareExchange((volatile signed __int32 *)(v15 + 44), 3, v19);
if( v19 == v20 )
{
if( *(_QWORD *)(v15 + 24) == v13 )
{
EtwpWaitForBufferReferenceCount((_WMI_BUFFER_HEADER *)v15);
if( v20 == 5 )
{
if( *(_DWORD *)(v15 + 8) == 72 )
{
_InterlockedExchange((volatile __int32 *)(v15 + 44), 0);
LABEL_61:
LOBYTE(v12) = 3;
goto LABEL_62;
}
v21 = (_WMI_BUFFER_HEADER *)(v15 + 72);
v22 = v15 + *(unsigned int *)(v15 + 8);
*(_QWORD *)(v15 + 104) = 0i64;
v23 = *(unsigned int *)(v15 + 72);
for( j = (char *)(v15 + 72 + v23); (unsigned __int64)j < v22; j = (char *)v21 + *(_DWORD *)v21 )
{
v25 = v21;
v21 = (_WMI_BUFFER_HEADER *)((char *)v21 + (unsigned int)v23);
*((_QWORD *)v21 + 4) = v25;
LODWORD(v23) = *(_DWORD *)v21;
}
do
{
if( EtwpPrepareHeader(LoggerContext, v21, 0x40ui64) != -2147483614 )
LogFile = EtwpFlushBufferToLogfile(LoggerContext, v21);
v21 = (_WMI_BUFFER_HEADER *)*((_QWORD *)v21 + 4);
}
while( v21 );
_InterlockedCompareExchange((volatile signed __int32 *)(v15 + 44), v19, 5);
}
else
{
if( v20 != 4 )
goto LABEL_61;
if( EtwpPrepareHeader(LoggerContext, (_WMI_BUFFER_HEADER *)v15, 0i64) != -2147483614 )
LogFile = EtwpFlushBufferToLogfile(LoggerContext, (_WMI_BUFFER_HEADER *)v15);
_InterlockedCompareExchange((volatile signed __int32 *)(v15 + 44), v19, 4);
}
if( LogFile < 0 )
goto LABEL_56;
goto LABEL_61;
}
_InterlockedCompareExchange((volatile signed __int32 *)(v15 + 44), v19, 3);
}
}
LABEL_62:
if( v13 < 0 )
goto LABEL_56;
}
}
goto LABEL_56;
}
v28 = EtwpQueryUsedProcessorCount(LoggerContext);
v29 = 0i64;
if( _InterlockedCompareExchange64(&LoggerContext->FlushingSequenceNumber, LoggerContext->BufferSequenceNumber, -1i64) == -1 )
{
if( LoggerContext->LastDroppedTime )
{
v30 = 0;
if( v28 )
{
v31 = 0i64;
do
{
QuadPart = LoggerContext->LastDroppedTime[v31].QuadPart;
v33 = LoggerContext->FlushingLastDroppedTime[v31].QuadPart;
if( QuadPart > v33 )
{
do
{
v34 = v33;
v33 = _InterlockedCompareExchange64(
(volatile signed __int64 *)&LoggerContext->FlushingLastDroppedTime[v30],
QuadPart,
v33);
}
while( v34 != v33 && QuadPart > v33 );
}
++v30;
++v31;
}
while( v30 < v28 );
}
}
do
{
v35 = EtwpFindAndLockBufferForFlushing(LoggerContext, LoggerContext->FlushingSequenceNumber);
v36 = v35;
if( !v35 )
break;
EtwpWaitForBufferReferenceCount(v35);
if( EtwpPrepareHeader(LoggerContext, v36, 0i64) != -2147483614 )
{
LogFile = EtwpFlushBufferToLogfile(LoggerContext, v36);
if( !v29 )
v29 = *((_QWORD *)v36 + 2);
}
_InterlockedDecrement64(&LoggerContext->FlushingSequenceNumber);
_InterlockedExchange((volatile __int32 *)v36 + 11, 0);
}
while( LogFile >= 0 );
if( LoggerContext->FlushingLastDroppedTime )
{
for( k = LoggerContext->GlobalList.Flink; ; k = v41[7] )
{
v41 = &k[-4].Blink;
if( k == &LoggerContext->GlobalList )
v41 = 0i64;
if( !v41 )
break;
v12 = (signed __int64)v41[2];
v38 = *((unsigned __int16 *)v41 + 20);
if( v12 < v29 && (__int64)v41[3] <= LoggerContext->FlushingSequenceNumber )
{
v39 = LoggerContext->FlushingLastDroppedTime[v38].QuadPart;
do
{
if( v12 <= v39 )
break;
v40 = v39;
v39 = _InterlockedCompareExchange64(
(volatile signed __int64 *)&LoggerContext->FlushingLastDroppedTime[v38],
v12,
v39);
}
while( v40 != v39 );
}
}
}
LABEL_56:
EtwpFinalizeHeader(LoggerContext, 0i64, v12);
LoggerContext->FlushingSequenceNumber = -1i64;
LoggerContext->BuffersWritten = 0;
goto LABEL_57;
}
return -1073741757;
}Referenced by:
EtwpFlushTrace