EtwpAddLastDroppedEvent

__int64 __fastcall EtwpAddLastDroppedEvent(__int64 a1, __int64 a2, int a3){
  INT64 v6; 
  unsigned int UsedProcessorCount; 
  UINT64 DataSize; 
  UINT64 RemainingBufferSize; 
  UINT64 EventSize; 
  if( !*(_QWORD *)(a1 + 1288) )
    return 3221225659i64;
  LODWORD(RemainingBufferSize) = a3 - *(_DWORD *)(a2 + 48);
  LODWORD(DataSize) = 8 * EtwpQueryUsedProcessorCount(a1) + 8;
  v6 = EtwpAddEventToBuffer(
         (_WMI_BUFFER_HEADER *)a2,
         0x52u,
         (_LARGE_INTEGER *)(a2 + 88),
         *(UINT8 **)(a1 + 1288),
         DataSize,
         RemainingBufferSize,
         &EventSize);
  if( !v6 )
    return 3221225990i64;
  UsedProcessorCount = EtwpQueryUsedProcessorCount(a1);
  *(_DWORD *)v6 = UsedProcessorCount;
  memmove((UINT8 *)(v6 + 8), *(UINT8 **)(a1 + 1288), 8i64 * UsedProcessorCount);
  return 0i64;
}

Referenced by: