EtwpGetMaxTrackingEventBufferSize

INT64 __fastcall EtwpGetMaxTrackingEventBufferSize(INT64 a1){
  int v2; 
  _QWORD *v3; 
  _QWORD *v4; 
  __int64 *v5; 
  int v6; 
  INT64 result; 
  __int64 v8; 
  int v9; 
  int v10; 
  v2 = 0;
  v3 = (_QWORD *)(a1 + 112);
  v4 = (_QWORD *)*v3;
  if( (_QWORD *)*v3 != v3 )
  {
    v8 = -1i64;
    do
      ++v8;
    while( *(&NtBuildLabEx + v8) );
    v2 = (v8 + 24) & 0xFFFFFFF8;
    do
    {
      v9 = *((_DWORD *)v4 + 5);
      v4 = (_QWORD *)*v4;
      v2 += (v9 + 19) & 0xFFFFFFF8;
    }
    while( v4 != v3 );
  }
  v5 = *(__int64 **)(a1 + 1024);
  while( v5 != (__int64 *)(a1 + 1024) )
  {
    v10 = *((_DWORD *)v5 + 4) + 16 * *((_DWORD *)v5 + 6) + 27;
    v5 = (__int64 *)*v5;
    v2 += v10 & 0xFFFFFFF8;
  }
  v6 = *(_DWORD *)(a1 + 136);
  if( v6 )
    v2 += (32 * v6 + 23) & 0xFFFFFFF8;
  result = (unsigned int)(v2 + 72);
  if( !v2 )
    return 0i64;
  return result;
}

Referenced by: