EtwpSavePersistedLoggersWorker

VOID __stdcall EtwpSavePersistedLoggersWorker(PVOID Context){
  char *PoolWithTag; 
  __int64 v2; 
  _QWORD *v3; 
  int v4; 
  __int64 i; 
  int v6; 
  WCHAR v7; 
  int v8; 
  v8 = 0;
  PoolWithTag = (char *)ExAllocatePoolWithTag(
                          PagedPool,
                          8i64 * *(unsigned int *)(EtwpHostSiloState + 16) + 4112,
                          0x4B777445ui64);
  v3 = PoolWithTag;
  if( !PoolWithTag )
    goto LABEL_9;
  *(_DWORD *)PoolWithTag = 0;
  *((_QWORD *)PoolWithTag + 1) = PoolWithTag + 4112;
  v4 = KsrEnumeratePersistedMemory(EtwpKsrGuid, EtwpKsrMemoryEnumCallback, PoolWithTag);
  if( v4 >= 0 )
  {
    for( i = 0i64; (unsigned int)i < *(_DWORD *)v3; i = (unsigned int)(i + 1) )
    {
      v6 = KsrQueryMetadata(EtwpKsrGuid, *(_QWORD *)(v3[1] + 8 * i), v3 + 2, 4096i64, &v8);
      if( v6 >= 0 )
        EtwpSavePersistedLogger((INT64)(v3 + 2), *(_QWORD *)(v3[1] + 8 * i), v7);
      else
        v4 = v6;
    }
  }
  ExFreePoolWithTag(v3, 0);
  if( v4 < 0 )
  {
LABEL_9:
    LOBYTE(v2) = 1;
    KsrFreePersistedMemory(EtwpKsrGuid, v2);
  }
  _InterlockedExchange(&EtwpLoggerSaveState, 2);
}

Referenced by: