EtwpWriteBufferCompressed

INT64 __fastcall EtwpWriteBufferCompressed(INT64 a1, UINT8 *a2){
  __int64 v2; 
  int v3; 
  unsigned int v4; 
  __int64 v7; 
  int v8; 
  UINT8 *v9; 
  int v10; 
  unsigned int v11; 
  int v12; 
  unsigned int v13; 
  unsigned int v14; 
  __int64 v15; 
  __int64 v16; 
  int v17; 
  ULONG v18; 
  ULONG Length; 
  NTSTATUS v20; 
  int v21; 
  int v22; 
  int v23; 
  int v24; 
  __int64 v25; 
  int v26; 
  int v27; 
  unsigned int v28; 
  int v29; 
  int v30; 
  UINT8 *v31; 
  PIO_STATUS_BLOCK IoStatusBlock; 
  UINT64 UncompressedChunkSize; 
  struct _IO_STATUS_BLOCK v35; 
  UINT64 v36; 
  v2 = *(unsigned int *)(a1 + 52);
  v3 = 0;
  v4 = *(_DWORD *)(a1 + 16);
  v7 = *(_QWORD *)(a1 + 40) + 72i64;
  v8 = *(_DWORD *)(a1 + 48) - v2;
  LODWORD(v36) = 0;
  v9 = (UINT8 *)(v2 + v7);
  v10 = *((_DWORD *)a2 + 12);
  v11 = v8 - 72;
  v35 = 0i64;
  if( v11 >= v4 )
    v11 = v4;
  LODWORD(UncompressedChunkSize) = 0;
  LODWORD(IoStatusBlock) = v11;
  v12 = RtlCompressBuffer(
          3u,
          a2 + 72,
          (unsigned int)(v10 - 72),
          v9,
          (UINT64)IoStatusBlock,
          UncompressedChunkSize,
          &v36,
          *(VOID **)(a1 + 32));
  v13 = v12;
  if( v12 == -1073741789 )
  {
    v14 = *((_DWORD *)a2 + 12);
    memmove((UINT8 *)(*(_QWORD *)(a1 + 40) + *(unsigned int *)(a1 + 52)), a2, v14);
  }
  else
  {
    if( v12 < 0 )
    {
      ++*(_DWORD *)(a1 + 24);
      return v13;
    }
    *((_WORD *)a2 + 26) |= 0x40u;
    v15 = *(unsigned int *)(a1 + 52);
    v16 = *(_QWORD *)(a1 + 40);
    *(_OWORD *)(v15 + v16) = *(_OWORD *)a2;
    *(_OWORD *)(v15 + v16 + 16) = *((_OWORD *)a2 + 1);
    *(_OWORD *)(v15 + v16 + 32) = *((_OWORD *)a2 + 2);
    *(_OWORD *)(v15 + v16 + 48) = *((_OWORD *)a2 + 3);
    *(_QWORD *)(v15 + v16 + 64) = *((_QWORD *)a2 + 8);
    v14 = v36 + 72;
  }
  *(_DWORD *)(*(unsigned int *)(a1 + 52) + *(_QWORD *)(a1 + 40)) = v14;
  v17 = *(_DWORD *)(a1 + 52);
  ++*(_DWORD *)(a1 + 56);
  v18 = v14 + v17;
  Length = *(_DWORD *)(a1 + 16);
  *(_DWORD *)(a1 + 52) = v18;
  if( v18 >= Length )
  {
    v20 = ZwWriteFile(
            *(HANDLE *)a1,
            0i64,
            0i64,
            0i64,
            &v35,
            *(PVOID *)(a1 + 40),
            Length,
            (PLARGE_INTEGER)(a1 + 8),
            0i64);
    v21 = *(_DWORD *)(a1 + 56);
    v13 = v20;
    if( v20 < 0 )
    {
      v22 = *(_DWORD *)(a1 + 24) + v21;
      v23 = *(_DWORD *)(a1 + 60);
      *(_DWORD *)(a1 + 52) = v23;
      LOBYTE(v3) = v23 != 0;
      v24 = v22 - 1;
      if( !v23 )
        v24 = v22;
      *(_DWORD *)(a1 + 24) = v24;
      goto LABEL_16;
    }
    v25 = *(unsigned int *)(a1 + 16);
    v26 = *(_DWORD *)(a1 + 52);
    v27 = *(_DWORD *)(a1 + 20);
    *(_QWORD *)(a1 + 8) += v25;
    v28 = v26 - v25;
    *(_DWORD *)(a1 + 52) = v28;
    *(_DWORD *)(a1 + 60) = v28;
    v29 = v21 + v27;
    if( !v28 )
    {
      *(_DWORD *)(a1 + 20) = v29;
LABEL_16:
      *(_DWORD *)(a1 + 56) = v3;
      return v13;
    }
    v30 = v29 - 1;
    v31 = *(UINT8 **)(a1 + 40);
    *(_DWORD *)(a1 + 20) = v30;
    *(_DWORD *)(a1 + 56) = 1;
    memmove(v31, &v31[v25], v28);
  }
  return v13;
}

Referenced by: