EtwSendTraceBuffer

UINT64 __fastcall EtwSendTraceBuffer(UINT64 *a1, INT64 a2, INT64 r8_0){
  __int64 v3; 
  unsigned int v4; 
  unsigned int v5; 
  __int64 v6; 
  unsigned int v7; 
  INT64 v10; 
  INT64 v11; 
  int v12; 
  bool v13; 
  signed __int64 v14; 
  CHAR a3; 
  __int64 v16; 
  v4 = 0;
  v5 = (unsigned __int16)a1;
  a3 = 0;
  v6 = v3;
  v7 = r8_0;
  if( (unsigned int)(unsigned __int16)a1 >= *(_DWORD *)(PsGetCurrentServerSiloGlobals()[108] + 16) )
    return 3221225480i64;
  v10 = EtwpOpenLogger(v5, EtwpHostSiloState, 0, &a3);
  v11 = v10;
  if( !v10 )
    return 3221226134i64;
  if( *(_DWORD *)(v10 + 336) )
  {
    if( (*(_DWORD *)(v10 + 12) & 0x40000) != 0 )
    {
      if( v7 )
        _InterlockedExchangeAdd((volatile signed __int32 *)(v10 + 256), v7);
      v12 = *(_DWORD *)(a2 + 48);
      *(_DWORD *)(a2 + 4) = v12;
      v13 = (*(_BYTE *)(a2 + 52) & 0x20) == 0;
      *(_DWORD *)(a2 + 8) = *(_DWORD *)a2 + v12;
      *(_DWORD *)(a2 + 44) = 3;
      *(_WORD *)(a2 + 54) = 5;
      if( v13 )
        *(_WORD *)(a2 + 40) = *(unsigned __int8 *)(a2 + 40);
      *(_QWORD *)(a2 + 64) = v16;
      *(_QWORD *)(a2 + 56) = v6;
      *(LARGE_INTEGER *)(a2 + 16) = EtwpGetLoggerTimeStamp(v10);
      do
      {
        v14 = *(_QWORD *)(v11 + 144);
        *(_QWORD *)(a2 + 32) = v14;
      }
      while( v14 != _InterlockedCompareExchange64((volatile signed __int64 *)(v11 + 144), a2, v14) );
      if( !v14 )
      {
        if( ObGetCurrentIrql() > 2u )
        {
          if( !_interlockedbittestandset((volatile signed __int32 *)(v11 + 836), 8u) )
            KeInsertQueueDpc((PRKDPC)(v11 + 584), 0i64, 0i64);
        }
        else
        {
          KeSetEvent((PRKEVENT)(v11 + 496), 0);
        }
      }
    }
    else
    {
      v4 = -1073741816;
    }
  }
  else
  {
    v4 = -1073741054;
  }
  EtwpCloseLogger(v5, EtwpHostSiloState, a3);
  return v4;
}

Referenced by: