EtwpFlushTrace

NTSTATUS __stdcall EtwpFlushTrace(_ETW_SILODRIVERSTATE *SiloState, _WMI_LOGGER_INFORMATION *LoggerInfo){
  NTSTATUS result; 
  INT16 v5; 
  INT64 v6; 
  _ETHREAD *CurrentThread; 
  int v8; 
  int LoggerInfoFromContext; 
  __int64 v10; 
  unsigned int v11; 
  int v12; 
  _UNICODE_STRING *v13; 
  NTSTATUS v14; 
  __int64 v15; 
  _UNICODE_STRING v16; 
  int v17; 
  _PERFINFO_GROUPMASK *v18; 
  unsigned int v19; 
  _UNICODE_STRING UnicodeString; 
  INT64 v21; 
  INT64 v22; 

  v22 = 0i64;
  UnicodeString = 0i64;
  result = EtwpValidateLoggerInfo(LoggerInfo);
  if( result >= 0 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    EtwpAcquireLoggerContext(
      (INT64)SiloState,
      v5,
      (INT64)&v22,
      v6,
      *(_MEMORY_CACHING_TYPE_ORIG **)&UnicodeString.Length,
      (INT64)UnicodeString.Buffer,
      v21);
    LoggerInfoFromContext = v8;
    if( v8 < 0 )
    {
LABEL_15:
      RtlFreeAnsiString(&UnicodeString);
      KeLeaveCriticalRegionThread(KeGetCurrentThread());
      return LoggerInfoFromContext;
    }
    v10 = v22;
    if( (*(_DWORD *)(v22 + 12) & 0x40000) != 0 )
    {
      LoggerInfoFromContext = -1073741637;
    }
    else
    {
      v11 = ((*(_DWORD *)(v22 + 12) & 0x100 | 0x400u) >> 3) | 0x40;
      if( !*(_QWORD *)(v22 + 816) )
        v11 = (*(_DWORD *)(v22 + 12) & 0x100 | 0x400u) >> 3;
      v12 = *(_DWORD *)(v22 + 12) & 0x400;
      if( v12 )
      {
        if( !*((_QWORD *)LoggerInfo + 17) || (v13 = (_UNICODE_STRING *)(LoggerInfo + 32), !*((_WORD *)LoggerInfo + 64)) )
        {
          LoggerInfoFromContext = -1073741809;
          goto LABEL_14;
        }
        v11 |= 0x40u;
      }
      else
      {
        v13 = (_UNICODE_STRING *)(LoggerInfo + 32);
      }
      LoggerInfoFromContext = EtwpCheckLoggerControlAccess(v11, (_WMI_LOGGER_CONTEXT *)v22);
      if( LoggerInfoFromContext >= 0 )
      {
        if( !v12 )
        {
          v14 = EtwpSynchronizeWithLogger((_WMI_LOGGER_CONTEXT *)v10, 4ui64);
LABEL_11:
          LoggerInfoFromContext = v14;
          if( v14 >= 0 )
          {
            LoggerInfoFromContext = EtwpGetLoggerInfoFromContext(LoggerInfo, (_WMI_LOGGER_CONTEXT *)v10);
            if( EtwEventEnabled(*(&ExBootDevicesRemovedEvent + 241), &ETW_EVENT_FLUSH_TRACE) )
              EtwpEventWriteTemplateSession(v15, &ETW_EVENT_FLUSH_TRACE, v10);
          }
          goto LABEL_14;
        }
        LoggerInfoFromContext = EtwpCaptureString(v13, &UnicodeString);
        if( LoggerInfoFromContext >= 0 )
        {
          v16 = UnicodeString;
          UnicodeString.Buffer = 0i64;
          *(_UNICODE_STRING *)(v10 + 200) = v16;
          _InterlockedOr((volatile signed __int32 *)(v10 + 836), 1u);
          v17 = *(_DWORD *)(v10 + 12);
          v10 = v22;
          if( (v17 & 0x2000000) != 0 )
          {
            v18 = &SiloState->SystemLoggerSettings.EtwpGroupMasks[*(unsigned __int8 *)(v22 + 834)];
            if( v18 )
            {
              v19 = v18->Masks[1];
              if( (v19 & 4) != 0 && (v19 & 0x100) != 0 )
                EtwpCCSwapStop(*(unsigned int *)(v22 + 216), 0);
            }
          }
          v14 = EtwpBufferingModeFlush((_WMI_LOGGER_CONTEXT *)v10);
          goto LABEL_11;
        }
      }
    }
LABEL_14:
    EtwpReleaseLoggerContext((_WMI_LOGGER_CONTEXT *)v10, 1u);
    goto LABEL_15;
  }
  return result;
}

Referenced by: