EtwpPreserveLogger

INT64 __fastcall EtwpPreserveLogger(INT64 a1){
  __int64 v1; 
  __int64 v4; 
  _QWORD *v5; 
  VOID *PoolWithTag; 
  __int64 v7; 
  int v8; 
  CHAR *TraceBuffer; 
  char *v10; 
  __int128 v11; 
  __int64 v12; 
  __int64 v13; 
  PVOID *v14; 
  __int64 v15; 
  __int128 Src; 
  PVOID P; 
  PVOID *v18; 
  v1 = *(_QWORD *)(a1 + 1072);
  P = 0i64;
  if( *(_BYTE *)(v1 + 33) )
    return 0i64;
  v4 = *(unsigned int *)(a1 + 4);
  v5 = 0i64;
  Src = *(_OWORD *)(v1 + 16);
  if( ((v4 * (unsigned int)(*(_DWORD *)(a1 + 248) + 1)) & 0xFFFFFFFFFFFFF000ui64) > 0xFFFFFFFF000i64 )
    return 3221225659i64;
  PoolWithTag = ExAllocatePoolWithTag(PagedPool, (unsigned int)(unsigned __int16)Src + 18, 0x4B777445ui64);
  v7 = (__int64)PoolWithTag;
  if( PoolWithTag )
  {
    memset((INT64)PoolWithTag, 0i64);
    *(_DWORD *)(v7 + 8) = *(_DWORD *)(a1 + 4);
    *(_DWORD *)(v7 + 12) = 16;
    memmove((UINT8 *)(v7 + 16), *((UINT8 **)&Src + 1), (unsigned int)(unsigned __int16)Src + 2);
    TraceBuffer = EtwpAllocateTraceBuffer(a1, (unsigned int)v4);
    v10 = TraceBuffer;
    if( !TraceBuffer )
    {
      v8 = -1073741801;
LABEL_23:
      ExFreePoolWithTag((PVOID)v7, 0);
      return(unsigned int)v8;
    }
    EtwpInitializeBufferHeader((__int16 *)a1, TraceBuffer);
    EtwpResetBufferHeader((__int64)v10, 4);
    v11 = *(_OWORD *)(a1 + 168);
    *(_OWORD *)(a1 + 168) = Src;
    EtwpAddLogHeader(a1, (__int64)v10);
    *(_OWORD *)(a1 + 168) = v11;
    v8 = EtwpBuildMdlForTraceBuffer(a1, v10, (struct _MDL **)&P);
    if( v8 >= 0 )
    {
      ++*(_DWORD *)(v7 + 4);
      v12 = *(_QWORD *)(a1 + 96);
      v5 = P;
      v13 = v12 - 56;
      if( v12 == a1 + 96 )
        v13 = 0i64;
      if( v13 )
      {
        v18 = (PVOID *)P;
        while( 1 )
        {
          v8 = EtwpBuildMdlForTraceBuffer(a1, (char *)v13, (struct _MDL **)&P);
          if( v8 < 0 )
            break;
          v14 = v18;
          v18 = (PVOID *)P;
          *v14 = P;
          ++*(_DWORD *)(v7 + 4);
          v15 = *(_QWORD *)(v13 + 56);
          v13 = v15 - 56;
          if( v15 == a1 + 96 )
            v13 = 0i64;
          if( !v13 )
            goto LABEL_18;
        }
      }
      else
      {
LABEL_18:
        v8 = EtwpPreserveMdlList(v5, v7, (unsigned int)(unsigned __int16)Src + 18, v1);
        if( v8 >= 0 )
        {
          *(_QWORD *)(v1 + 8) = v10;
          *(_BYTE *)(v1 + 33) = 1;
          goto LABEL_21;
        }
      }
    }
    EtwpFreeTraceBuffer(a1, v10);
LABEL_21:
    if( v5 )
      ExFreePoolWithTag(v5, 0);
    goto LABEL_23;
  }
  return(unsigned int)-1073741670;
}

Referenced by: