EtwGetProcessorBuffer
INT64 __fastcall EtwGetProcessorBuffer(UINT64 a1, UINT64 a2, INT64 a3){
unsigned int v3;
__int64 v6;
__int64 v7;
unsigned int *v8;
unsigned int v9;
v3 = 0;
if( !EtwpInitialized )
return 3221225473i64;
if( (unsigned int)a1 >= *(_DWORD *)(EtwpHostSiloState + 16) )
{
v6 = 1i64;
}
else
{
_mm_lfence();
v6 = *(_QWORD *)(*(_QWORD *)(EtwpHostSiloState + 456) + 8i64 * (unsigned int)a1);
}
if( (v6 & 1) != 0 )
{
return(unsigned int)-1073741816;
}
else if( *(_DWORD *)(v6 + 316) == 1 )
{
return(unsigned int)-1073741811;
}
else
{
if( (*(_DWORD *)(v6 + 12) & 0x10000000) != 0 )
v7 = *(_QWORD *)(v6 + 144);
else
v7 = *(_QWORD *)(*(_QWORD *)(*(_QWORD *)(*(_QWORD *)(v6 + 1080) + 4136i64)
+ ((unsigned __int64)(unsigned int)a2 << 6))
+ 8i64 * (unsigned int)a1);
v8 = (unsigned int *)(v7 & 0xFFFFFFFFFFFFFFF0ui64);
if( v8 )
{
*(_DWORD *)(a3 + 8) = *v8;
v9 = v8[2];
*(_QWORD *)a3 = v8;
if( v9 <= *v8 )
*(_DWORD *)(a3 + 12) = v8[2];
else
*(_DWORD *)(a3 + 12) = v8[1];
}
else
{
return(unsigned int)-1073741823;
}
}
return v3;
}Referenced by:
KiSaveCurrentEtwTraceBuffer