EtwpCoverageSamplerStart

NTSTATUS __stdcall EtwpCoverageSamplerStart(PVOID Object){
  INT64 v2; 
  unsigned __int64 v3; 
  unsigned int v4; 
  CHAR *Table; 
  NTSTATUS ImageNotifyRoutine; 
  PVOID *v7; 
  unsigned int v8; 
  unsigned int v9; 
  int v10; 
  __int64 v11; 
  _EPROCESS *v12; 
  VOID *v13; 
  INT64 v14; 
  int v15; 
  int v16; 
  VOID *v18; 
  VOID *v19; 
  _KPROFILE_SOURCE v20; 
  __int128 v21; 
  __int64 v22; 
  int v23; 

  v23 = 0;
  v2 = *((unsigned int *)Object + 9);
  LODWORD(v3) = 0;
  v21 = 0i64;
  v22 = 0i64;
  v4 = 0;
  Table = EtwpCoverageSamplerAllocateTable(v2);
  *((_QWORD *)Object + 144) = Table;
  if( !Table )
  {
    ImageNotifyRoutine = -1073741670;
    goto LABEL_28;
  }
  ++*((_DWORD *)Object + 296);
  v7 = (PVOID *)*((_QWORD *)Object + 147);
  if( *v7 != (char *)Object + 1168 )
    __fastfail(3u);
  *(_QWORD *)Table = (char *)Object + 1168;
  *((_QWORD *)Table + 1) = v7;
  *v7 = Table;
  *((_QWORD *)Object + 147) = Table;
  v8 = *((_DWORD *)Object + 17);
  v9 = *((_DWORD *)Object + 16);
  if( v8 )
    v9 /= v8;
  v10 = *((_DWORD *)Object + 6);
  if( (v10 & 4) != 0 )
    goto LABEL_15;
  if( (v10 & 2) == 0 )
  {
    LODWORD(v21) = 2;
    if( ((int(__fastcall *)(__int64, __int64, __int128 *, int *))off_140C00A68[0])(1i64, 24i64, &v21, &v23) >= 0
      && BYTE4(v21) )
    {
      v4 = 2;
      v3 = v9 * (unsigned __int64)*(&ExBootDevicesRemovedEvent + 381) / 5;
      goto LABEL_15;
    }
    if( (*((_DWORD *)Object + 6) & 1) != 0 )
    {
      ImageNotifyRoutine = -1073741637;
      goto LABEL_28;
    }
  }
  LODWORD(v3) = 10 * v9;
LABEL_15:
  KeEnterCriticalRegion();
  ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)&ExBootDevicesRemovedEvent + 148, 0i64);
  *(&ExBootDevicesRemovedEvent + 149) = KeGetCurrentThread();
  if( *(&ExBootDevicesRemovedEvent + 151) )
  {
    ImageNotifyRoutine = -1073740008;
  }
  else
  {
    ImageNotifyRoutine = EtwpCovSampCaptureContextStart((_DWORD *)Object + 6);
    if( ImageNotifyRoutine >= 0 )
    {
      v11 = *(&ExBootDevicesRemovedEvent + 153);
      ObfReferenceObject(Object);
      *(&ExBootDevicesRemovedEvent + 151) = Object;
      ExReInitializeRundownProtection((INT64 *)&ExBootDevicesRemovedEvent + 152);
      *((_DWORD *)Object + 287) |= 1u;
      ImageNotifyRoutine = PsSetLoadImageNotifyRoutine(EtwpCovSampImageNotify);
      if( ImageNotifyRoutine >= 0 )
      {
        *((_DWORD *)Object + 287) |= 2u;
        PsEnumProcesses((INT64)EtwpCovSampEnumerateProcess, (INT64 *)Object + 2, v12, v13, v18);
        MmEnumerateSystemImages(
          (__int64(__fastcall *)(INT64 *, __int64))EtwpCovSampEnumerateDriver,
          (__int64)Object + 16);
        v14 = EtwpHostSiloState;
        v15 = *(_DWORD *)(EtwpHostSiloState + 4548) | 4;
        *(_DWORD *)(EtwpHostSiloState + 4548) = v15;
        v16 = *((_DWORD *)Object + 6);
        if( (v16 & 8) == 0 )
        {
          *(_DWORD *)(v14 + 4552) |= 4u;
          v16 = *((_DWORD *)Object + 6);
        }
        if( (v16 & 0x10) == 0 )
        {
          *(_DWORD *)(v14 + 4552) |= 0x200u;
          v16 = *((_DWORD *)Object + 6);
        }
        if( (v16 & 0x20) == 0 )
          *(_DWORD *)(v14 + 4548) = v15 | 0x1000;
        EtwpUpdateGlobalGroupMasks(v14, 0i64, 9ui64);
        *((_DWORD *)Object + 287) |= 4u;
        if( (*((_DWORD *)Object + 6) & 4) == 0 )
        {
          KeInitializeProfileCallback(
            (_KPROFILE *)(v11 + 16),
            EtwpCovSampProfileInterrupt,
            (_KTRAP_FRAME *)v11,
            (VOID *)v4,
            v19,
            v20);
          KeSetIntervalProfile((unsigned int)v3, (_KPROFILE_SOURCE)*(__int16 *)(v11 + 256));
          KeStartProfile((_KPROFILE *)(v11 + 16));
          *((_DWORD *)Object + 287) |= 8u;
        }
        ImageNotifyRoutine = 0;
      }
    }
  }
LABEL_28:
  if( (struct _KTHREAD *)*(&ExBootDevicesRemovedEvent + 149) == KeGetCurrentThread() )
  {
    *(&ExBootDevicesRemovedEvent + 149) = 0i64;
    if( (_InterlockedExchangeAdd64((_QWORD *)&ExBootDevicesRemovedEvent + 148, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((_EX_PUSH_LOCK *)&ExBootDevicesRemovedEvent + 148);
    KeAbPostRelease((char *)&ExBootDevicesRemovedEvent + 1184);
    KeLeaveCriticalRegion();
  }
  return ImageNotifyRoutine;
}

Referenced by: