EtwGetProcessorBuffer

INT64 __fastcall EtwGetProcessorBuffer(UINT64 a1, UINT64 a2, INT64 a3){
  unsigned int v3; 
  __int64 v6; 
  __int64 v7; 
  unsigned int *v8; 
  unsigned int v9; 
  v3 = 0;
  if( !EtwpInitialized )
    return 3221225473i64;
  if( (unsigned int)a1 >= *(_DWORD *)(EtwpHostSiloState + 16) )
  {
    v6 = 1i64;
  }
  else
  {
    _mm_lfence();
    v6 = *(_QWORD *)(*(_QWORD *)(EtwpHostSiloState + 456) + 8i64 * (unsigned int)a1);
  }
  if( (v6 & 1) != 0 )
  {
    return(unsigned int)-1073741816;
  }
  else if( *(_DWORD *)(v6 + 316) == 1 )
  {
    return(unsigned int)-1073741811;
  }
  else
  {
    if( (*(_DWORD *)(v6 + 12) & 0x10000000) != 0 )
      v7 = *(_QWORD *)(v6 + 144);
    else
      v7 = *(_QWORD *)(*(_QWORD *)(*(_QWORD *)(*(_QWORD *)(v6 + 1080) + 4136i64)
                                 + ((unsigned __int64)(unsigned int)a2 << 6))
                     + 8i64 * (unsigned int)a1);
    v8 = (unsigned int *)(v7 & 0xFFFFFFFFFFFFFFF0ui64);
    if( v8 )
    {
      *(_DWORD *)(a3 + 8) = *v8;
      v9 = v8[2];
      *(_QWORD *)a3 = v8;
      if( v9 <= *v8 )
        *(_DWORD *)(a3 + 12) = v8[2];
      else
        *(_DWORD *)(a3 + 12) = v8[1];
    }
    else
    {
      return(unsigned int)-1073741823;
    }
  }
  return v3;
}

Referenced by:

KiSaveCurrentEtwTraceBuffer