EtwpFinalizeHeader

NTSTATUS __fastcall EtwpFinalizeHeader(__int64 a1, char a2){
  _QWORD *v2; 
  char v4; 
  NTSTATUS result; 
  unsigned int Length; 
  unsigned int v7; 
  _LARGE_INTEGER *Buffer; 
  void *v9; 
  NTSTATUS v10; 
  union _LARGE_INTEGER v11; 
  int v12; 
  unsigned int HighPart; 
  unsigned int LowPart; 
  NTSTATUS v15; 
  int v16; 
  unsigned int v17; 
  unsigned __int64 v18; 
  VOID *v19; 
  INT64 FsInformationClass; 
  union _LARGE_INTEGER ByteOffset; 
  int v23; 
  int v24; 
  struct _IO_STATUS_BLOCK IoStatusBlock; 
  unsigned __int64 FileInformation; 
  IO_STATUS_BLOCK v27; 
  __int128 FsInformation; 
  __int64 v29; 
  v29 = 0i64;
  v2 = (_QWORD *)(a1 + 112);
  FsInformation = 0i64;
  IoStatusBlock = 0i64;
  if( (_QWORD *)*v2 != v2
    || *(_QWORD *)(a1 + 1024) != a1 + 1024
    || *(_DWORD *)(a1 + 136)
    || (v4 = 0, *(_QWORD *)(a1 + 1288)) )
  {
    v4 = 1;
  }
  result = ZwQueryVolumeInformationFile(
             *(HANDLE *)(a1 + 816),
             &IoStatusBlock,
             &FsInformation,
             0x18u,
             FileFsSizeInformation);
  if( result >= 0 )
  {
    v23 = HIDWORD(v29);
    Length = ~(HIDWORD(v29) - 1) & (HIDWORD(v29) + 383);
    v24 = ~(HIDWORD(v29) - 1);
    v7 = Length;
    if( v4 )
      v7 = *(_DWORD *)(a1 + 4);
    Buffer = (_LARGE_INTEGER *)ExAllocatePoolWithTag(PagedPool, (v7 + 4095i64) & 0xFFFFFFFFFFFFF000ui64, 0x50777445ui64);
    if( !Buffer )
      return -1073741801;
    v9 = *(void **)(a1 + 816);
    ByteOffset.QuadPart = 0i64;
    v10 = ZwReadFile(v9, 0i64, 0i64, 0i64, &IoStatusBlock, Buffer, Length, &ByteOffset, 0i64);
    if( v10 < 0 )
      goto LABEL_21;
    v11.QuadPart = Length;
    ByteOffset.QuadPart = Length;
    if( !a2 )
    {
      Buffer[17].HighPart = *(_DWORD *)(a1 + 264);
      Buffer[14].HighPart = EtwpQueryUsedProcessorCount(a1);
      Buffer[19].LowPart += *(_DWORD *)(a1 + 256);
      KeQuerySystemTimePrecise(Buffer + 15);
      if( EtwpIsWow64Logger(a1) )
        Buffer[46].HighPart += v12;
      else
        Buffer[47].HighPart += v12;
      Buffer[14].LowPart = (unsigned __int16)NtBuildNumber;
      v11 = ByteOffset;
    }
    HighPart = Buffer->HighPart;
    if( HighPart > v11.LowPart )
    {
      if( !v4 )
      {
LABEL_16:
        ByteOffset.QuadPart = 0i64;
        LowPart = Buffer[6].LowPart;
        if( LowPart >= v7 )
          LowPart = v7;
        v15 = ZwWriteFile(
                *(HANDLE *)(a1 + 816),
                0i64,
                0i64,
                0i64,
                &IoStatusBlock,
                Buffer,
                v24 & (LowPart + v23 - 1),
                &ByteOffset,
                0i64);
        v10 = v15;
        if( !a2 && v15 >= 0 )
        {
          v16 = *(_DWORD *)(a1 + 12);
          if( (v16 & 0x20) != 0 )
          {
            v18 = *(unsigned int *)(a1 + 4) * (unsigned __int64)*(unsigned int *)(a1 + 264);
            v27 = 0i64;
            if( v18 < *(unsigned int *)(a1 + 308)
                     * ((-(__int64)((v16 & 0x2000) != 0) & 0xFFFFFFFFFFF00400ui64) + 0x100000) )
            {
              v19 = *(VOID **)(a1 + 816);
              FileInformation = v18;
              v10 = ZwSetInformationFile(v19, &v27, &FileInformation, 8ui64, FileEndOfFileInformation);
            }
          }
        }
LABEL_21:
        ExFreePoolWithTag(Buffer, 0);
        return v10;
      }
      v17 = Buffer->HighPart;
      if( HighPart >= v7 )
        v17 = v7;
      v10 = ZwReadFile(
              *(HANDLE *)(a1 + 816),
              0i64,
              0i64,
              0i64,
              &IoStatusBlock,
              (char *)Buffer + v11.QuadPart,
              v24 & (v17 - v11.LowPart + v23 - 1),
              &ByteOffset,
              0i64);
      if( v10 < 0 )
        goto LABEL_21;
    }
    if( v4 && HighPart < v7 && HighPart >= 0x178 )
    {
      Buffer[6].LowPart = HighPart;
      if( *(_QWORD *)(a1 + 1288) )
        EtwpAddLastDroppedEvent(a1, (__int64)Buffer, v7);
      if( (_QWORD *)*v2 != v2 || *(_DWORD *)(a1 + 136) )
      {
        LODWORD(FsInformationClass) = 3;
        EtwpAddDebugInfoEvents(a1, (INT64)Buffer, v7, (INT64 *)&Buffer[11], FsInformationClass);
      }
      if( *(_QWORD *)(a1 + 1024) != a1 + 1024 )
        EtwpAddBinaryInfoEvents((_WMI_LOGGER_CONTEXT *)a1, (_WMI_BUFFER_HEADER *)Buffer, v7);
    }
    goto LABEL_16;
  }
  return result;
}

Referenced by: