EtwpDequeueFreeBuffer

_WMI_BUFFER_HEADER *__stdcall EtwpDequeueFreeBuffer(_WMI_LOGGER_CONTEXT *LoggerContext){
  char v1; 
  bool v3; 
  _WMI_LOGGER_CONTEXT *v4; 
  unsigned int *v5; 
  unsigned int *v6; 
  unsigned int *v7; 
  signed __int32 v8; 
  _LARGE_INTEGER *LastDroppedTime; 
  __int64 v10; 
  signed __int64 QuadPart; 
  signed __int64 v12; 
  signed __int64 v13; 
  unsigned int *v15; 
  _WMI_LOGGER_CONTEXT *v16; 
  _SINGLE_LIST_ENTRY *Next; 
  unsigned int *v18; 
  _WMI_LOGGER_CONTEXT *v19; 
  signed __int64 v20; 
  signed __int64 v21; 
  signed __int64 v22; 
  _ETW_LOCK_HANDLE LockHandle; 

  v1 = 0;
  v3 = LoggerContext->BufferQueue.QueueEntry.Next == 0i64;
  LockHandle.OldIrql = 0;
  if( v3 && !LoggerContext->OverflowQueue.QueueEntry.Next )
    return 0i64;
  if( (LoggerContext->LoggerMode & 0x400) != 0 )
  {
    EtwpLockBufferList(LoggerContext, &LockHandle);
    EtwpDequeueBuffer(LoggerContext, &LoggerContext->OverflowQueue);
    v6 = v5;
    if( !v5 )
    {
      EtwpDequeueBuffer(v4, &LoggerContext->BufferQueue);
      v6 = v7;
    }
    if( LoggerContext->CompressionOn )
    {
      Next = LoggerContext->BufferQueue.QueueEntry.Next;
      if( !Next || ((HIDWORD(Next[1].Next) - 4) & 0xFFFFFFFD) == 0 )
        v1 = 1;
    }
    EtwpUnlockBufferList(LoggerContext, &LockHandle);
    if( v1 )
      EtwpDisableCompression(LoggerContext);
    if( !v6 )
      return 0i64;
    do
    {
      _InterlockedDecrement(&LoggerContext->BuffersAvailable);
      if( (LoggerContext->LoggerMode & 0x4000000) != 0 )
      {
        v8 = v6[11];
        if( (unsigned int)(v8 - 4) <= 1 )
          goto LABEL_12;
      }
      v8 = 0;
LABEL_12:
      if( !v6[3] && v8 == _InterlockedCompareExchange((volatile signed __int32 *)v6 + 11, 1, v8) )
        break;
      EtwpEnqueueOverflowBuffer(LoggerContext, (_WMI_BUFFER_HEADER *)v6);
      EtwpLockBufferList(LoggerContext, &LockHandle);
      EtwpDequeueBuffer(LoggerContext, &LoggerContext->BufferQueue);
      v6 = v18;
      EtwpUnlockBufferList(v19, &LockHandle);
    }
    while( v6 );
    if( !v6 )
      return 0i64;
    LastDroppedTime = LoggerContext->LastDroppedTime;
    if( LastDroppedTime )
    {
      v10 = *((unsigned __int16 *)v6 + 20);
      QuadPart = LastDroppedTime[v10].QuadPart;
      do
      {
        v12 = *((_QWORD *)v6 + 2);
        if( v12 <= QuadPart )
          break;
        v13 = QuadPart;
        QuadPart = _InterlockedCompareExchange64(
                     (volatile signed __int64 *)&LoggerContext->LastDroppedTime[v10],
                     v12,
                     QuadPart);
      }
      while( v13 != QuadPart );
      if( *((_QWORD *)v6 + 3) <= LoggerContext->FlushingSequenceNumber )
      {
        v20 = LoggerContext->FlushingLastDroppedTime[v10].QuadPart;
        do
        {
          v22 = *((_QWORD *)v6 + 2);
          if( v22 <= v20 )
            break;
          v21 = v20;
          v20 = _InterlockedCompareExchange64(
                  (volatile signed __int64 *)&LoggerContext->FlushingLastDroppedTime[v10],
                  v22,
                  v20);
        }
        while( v21 != v20 );
      }
    }
    EtwpResetBufferHeader((_WMI_BUFFER_HEADER *)v6, 0);
  }
  else
  {
    EtwpLockBufferList(LoggerContext, &LockHandle);
    EtwpDequeueBuffer(LoggerContext, &LoggerContext->BufferQueue);
    v6 = v15;
    EtwpUnlockBufferList(v16, &LockHandle);
    if( !v6 )
      return 0i64;
    EtwpResetBufferHeader((_WMI_BUFFER_HEADER *)v6, 0);
    v6[11] = 1;
    _InterlockedDecrement(&LoggerContext->BuffersAvailable);
  }
  if( LoggerContext->BufferSize != *v6 )
    KeBugCheckEx(0x11Du, (PVOID)7, v6, (PVOID)LoggerContext->BufferSize, (PVOID)*v6);
  return(_WMI_BUFFER_HEADER *)v6;
}

Referenced by: