VslpSkStartProfiling
NTSTATUS __stdcall VslpSkStartProfiling(UINT16 *a1){
NTSTATUS result;
unsigned int v3;
unsigned int v4;
unsigned __int64 v5;
size_t v6;
VOID **PoolWithTag;
_DWORD *v8;
size_t v9;
int v10;
UINT64 v11;
INT64 v12[2];
__int128 v13;
*(_OWORD *)v12 = 0i64;
v13 = 0i64;
result = WmiQueryTraceInformation(TraceSessionSettingsClass, v12, 0x20ui64, &v11, a1);
if( result >= 0 )
{
v3 = HIDWORD(v12[1]);
v4 = HIDWORD(v12[0]);
v5 = ((unsigned __int64)HIDWORD(v12[1]) + 63) >> 6;
if( HIDWORD(v12[0]) > 0x48 )
{
if( DWORD1(v13) )
VslpFlushTimerInterval = DWORD1(v13);
v6 = 16 * (((unsigned __int64)HIDWORD(v12[1]) + 63) >> 6) + HIDWORD(v12[1]) * HIDWORD(v12[0]) + 24;
PoolWithTag = ExAllocatePoolWithTag(0x200ui64, v6, 1416850774i64);
*(&stru_140C452E0 + 960) = PoolWithTag;
v8 = PoolWithTag;
if( PoolWithTag )
{
memset(PoolWithTag, 0i64, v6);
v8[2] = v5;
v9 = 8 * v5;
v8[1] = v4;
v8[3] = v6;
*v8 = v3;
memset(v8 + 6, 255i64, v9);
memset(&v8[2 * v8[2] + 6], 0i64, v9);
*(&stru_140C452E0 + 959) = *a1;
VslpSkCreateBuffers(v4, v3);
ExInitializePushLock((PULONG_PTR)&stru_140C452E0 + 956);
v10 = VslpSkMapBuffers();
if( v10 >= 0 )
{
KeInitializeTimerEx((INT64)&stru_140C452E0 + 7712, 0);
KeInitializeDpc((PRKDPC)((char *)&stru_140C452E0 + 7776), VslpSkFlushBufferCallback, 0i64);
KiSetTimerEx(
(_KTIMER *)((char *)&stru_140C452E0 + 7712),
(_LARGE_INTEGER)(-10000000i64 * (unsigned int)VslpFlushTimerInterval),
0i64,
0,
(_KDPC *)((char *)&stru_140C452E0 + 7776));
}
else
{
ExFreePoolWithTag(*(&stru_140C452E0 + 960), 0x54736D56u);
*(&stru_140C452E0 + 960) = 0i64;
*(&stru_140C452E0 + 959) = 0i64;
}
return v10;
}
else
{
return -1073741670;
}
}
else
{
return -1073741811;
}
}
return result;
}Referenced by:
VslpEtwClassicCallback