EtwpCoverageSamplerContextSwap
void __fastcall EtwpCoverageSamplerContextSwap(__int64 a1){
__int64 v1;
unsigned int v2;
unsigned int v3;
__int64 v4;
unsigned int LowPart;
int v6;
int v7;
int v8;
unsigned int v9;
unsigned int v10;
unsigned int v11;
int v12;
int v13;
if( a1 && a1 != *(_QWORD *)StartContext && a1 != *((_QWORD *)KeGetCurrentPrcb() + 3) )
{
v1 = (*(_QWORD *)(StartContext + 8) >> 4) & 0x1FFi64;
v2 = ((unsigned int)*(_QWORD *)(StartContext + 8) >> 13) & 0x3FFFF;
_BitScanReverse(&v3, v2);
v4 = *(_QWORD *)(*(_QWORD *)(*((_QWORD *)KeGetCurrentPrcb() + 4198) + 8i64 * (v3 - 2)) + 8i64 * (v2 ^ (1 << v3)) + 8);
if( !*(_DWORD *)(v4 + 8 * v1 + 184) )
{
LABEL_14:
_InterlockedIncrement((volatile signed __int32 *)(v4 + 8 * v1 + 324));
EtwpCovSampCaptureSample(0i64, 0x50000004ui64);
return;
}
LowPart = KUSER_SHARED_DATA.TickCount.LowPart;
if( KUSER_SHARED_DATA.TickCount.LowPart - *(_DWORD *)(v4 + 8 * v1 + 188) > *(_DWORD *)(v4 + 8 * v1 + 192) )
{
v6 = *(_DWORD *)(v4 + 8 * v1 + 184);
*(_DWORD *)(v4 + 8 * v1 + 204) += v6;
v7 = *(_DWORD *)(v4 + 8 * v1 + 204);
v8 = *(_DWORD *)(v4 + 8 * v1 + 212);
if( v7 > *(_DWORD *)(v4 + 8 * v1 + 196) )
v7 = *(_DWORD *)(v4 + 8 * v1 + 196);
*(_DWORD *)(v4 + 8 * v1 + 188) = LowPart;
v9 = *(_DWORD *)(v4 + 8 * v1 + 200) + v8;
*(_DWORD *)(v4 + 8 * v1 + 200) = 0;
v10 = v9 >> 1;
*(_DWORD *)(v4 + 8 * v1 + 204) = v7;
*(_DWORD *)(v4 + 8 * v1 + 212) = v10;
if( v10 >= 2 * v6 )
{
v11 = v10 / (v6 + 1);
v12 = LowPart ^ *(_DWORD *)(v4 + 8 * v1 + 220);
*(_DWORD *)(v4 + 8 * v1 + 216) = v11;
*(_DWORD *)(v4 + 8 * v1 + 220) = 16777619 * v12;
*(_DWORD *)(v4 + 8 * v1 + 208) = (16777619 * v12) & (2 * v11);
}
else
{
*(_DWORD *)(v4 + 8 * v1 + 216) = 1;
*(_DWORD *)(v4 + 8 * v1 + 208) = 1;
}
}
++*(_DWORD *)(v4 + 8 * v1 + 200);
v13 = *(_DWORD *)(v4 + 8 * v1 + 204);
if( v13 > 0 && (int)--*(_DWORD *)(v4 + 8 * v1 + 208) <= 0 )
{
*(_DWORD *)(v4 + 8 * v1 + 204) = v13 - 1;
*(_DWORD *)(v4 + 8 * v1 + 208) = *(_DWORD *)(v4 + 8 * v1 + 216);
goto LABEL_14;
}
}
}Referenced by:
EtwTraceContextSwap