PoTraceSystemTimerResolution

VOID __stdcall PoTraceSystemTimerResolution(UINT8 Rundown, _EPROCESS *Process){
  char v4; 
  REGHANDLE v5; 
  _OBJECT_NAME_INFORMATION *ImageFileName; 
  _ETHREAD *CurrentThread; 
  _DWORD *Teb; 
  _EWOW64PROCESS *WoW64Process; 
  unsigned __int16 Machine; 
  int v11; 
  int v12; 
  ULONG v13; 
  const _EVENT_DESCRIPTOR *v14; 
  _PO_DIAG_STACK_RECORD *TimerResolutionStackRecord; 
  __int16 v16; 
  int v17; 
  unsigned int RequestedTimerResolution; 
  int UniqueProcessId; 
  unsigned int StackDepth; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  int *p_UniqueProcessId; 
  int v23; 
  int v24; 
  __int16 *v25; 
  int v26; 
  int v27; 
  __int64 v28; 
  int v29; 
  int v30; 
  int *p_StackDepth; 
  int v32; 
  int v33; 
  void **Stack; 
  unsigned int v35; 
  int v36; 

  if( Rundown )
  {
    v5 = PopDiagHandle;
    v4 = EtwEventEnabled(PopDiagHandle, &POP_ETW_EVENT_TIME_RESOLUTION_REQUEST_RUNDOWN)
      || EtwEventEnabled(v5, &POP_ETW_EVENT_TIME_RESOLUTION_STACK_RUNDOWN);
  }
  else
  {
    v4 = EtwEventEnabled(PopDiagHandle, &POP_ETW_EVENT_STRS);
  }
  if( PopDiagHandleRegistered && v4 )
  {
    ImageFileName = Process->SeAuditProcessCreationInfo.ImageFileName;
    v16 = *(_WORD *)ImageFileName >> 1;
    RequestedTimerResolution = Process->RequestedTimerResolution;
    v17 = 0;
    if( !Rundown )
    {
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      if( (CurrentThread->Tcb._bf_0 & 0x400) != 0 || CurrentThread->Tcb.ApcStateIndex == 1 )
        Teb = 0i64;
      else
        Teb = CurrentThread->Tcb.Teb;
      if( Teb )
      {
        if( KeGetCurrentThread()->ApcState.Process->WoW64Process
          && (WoW64Process = KeGetCurrentThread()->ApcState.Process->WoW64Process) != 0i64
          && ((Machine = WoW64Process->Machine, Machine == 332) || Machine == 452) )
        {
          v11 = Teb[3032];
        }
        else
        {
          v11 = Teb[1480];
        }
        v17 = v11;
      }
    }
    UniqueProcessId = (int)Process->UniqueProcessId;
    UserData.Ptr = (unsigned __int64)&RequestedTimerResolution;
    UserData.Size = 4;
    UserData.Reserved = 0;
    p_UniqueProcessId = &UniqueProcessId;
    v23 = 4;
    v24 = 0;
    v25 = &v16;
    v26 = 2;
    v27 = 0;
    v12 = *(_WORD *)ImageFileName;
    v28 = *((_QWORD *)ImageFileName + 1);
    v29 = v12;
    v30 = 0;
    if( Rundown )
    {
      if( (Process->Flags & 0x1000) != 0 )
        EtwWrite(PopDiagHandle, &POP_ETW_EVENT_TIME_RESOLUTION_REQUEST_RUNDOWN, 0, 4u, &UserData);
      TimerResolutionStackRecord = Process->TimerResolutionStackRecord;
      if( !TimerResolutionStackRecord || !TimerResolutionStackRecord->StackDepth )
        return;
      RequestedTimerResolution = Process->SmallestTimerResolution;
      StackDepth = TimerResolutionStackRecord->StackDepth;
      p_StackDepth = (int *)&StackDepth;
      Stack = TimerResolutionStackRecord->Stack;
      v35 = 8 * StackDepth;
      v36 = 0;
      v13 = 6;
      v14 = &POP_ETW_EVENT_TIME_RESOLUTION_STACK_RUNDOWN;
    }
    else
    {
      p_StackDepth = &v17;
      v13 = 5;
      v14 = &POP_ETW_EVENT_STRS;
    }
    v32 = 4;
    v33 = 0;
    EtwWrite(PopDiagHandle, v14, 0, v13, &UserData);
  }
}

Referenced by: