EtwpCovSampCaptureContextStart
__int64 __fastcall EtwpCovSampCaptureContextStart(_DWORD *a1){
PVOID *StartContext;
PVOID *PoolWithTag;
NTSTATUS v4;
__int64 **v5;
INT64 v6;
PVOID v7;
void *v8;
_KTHREAD *v9;
int v10;
unsigned int MaximumProcessorCount;
int v12;
__int64 v13;
__int64 v14;
unsigned int v15;
__int64 v16;
__int64 v17;
__int64 v18;
bool v19;
unsigned int LowPart;
__int64 *v21;
unsigned int v22;
UINT64 Object;
UINT64 Objectb;
UINT64 Objecta;
HANDLE Handle;
__int64 v28;
int v29;
PVOID v30;
__int64 v31;
int ThreadInformation[4];
StartContext = (PVOID *)::StartContext;
Handle = 0i64;
if( !::StartContext )
{
PoolWithTag = (PVOID *)ExAllocatePoolWithTag(NonPagedPoolNx, 0x3D0ui64, 0x56777445ui64);
StartContext = PoolWithTag;
if( !PoolWithTag )
{
v4 = -1073741670;
goto LABEL_30;
}
memset((INT64)PoolWithTag, 0i64);
StartContext[1] = (PVOID)-1i64;
KeInitializeEvent((_KEVENT *)StartContext + 28, NotificationEvent, 0);
KeInitializeDpc((PRKDPC)(StartContext + 76), EtwpCovSampCaptureRebalanceDpc, StartContext);
InitializeSListHead((_SLIST_HEADER *)(StartContext + 88));
KeInitializeEvent((_KEVENT *)(StartContext + 92), NotificationEvent, 0);
KeInitializeDpc((PRKDPC)(StartContext + 95), EtwpCovSampCaptureQueueDpc, StartContext);
KeInitializeDpc((PRKDPC)(StartContext + 103), EtwpCovSampCaptureCleanupDpc, StartContext);
KeInitializeEvent((_KEVENT *)StartContext + 37, NotificationEvent, 0);
*((_DWORD *)StartContext + 231) = (*a1 >> 11) & 1;
::StartContext = (INT64)StartContext;
}
v5 = (__int64 **)(StartContext + 72);
StartContext[75] = StartContext + 74;
StartContext[73] = StartContext + 72;
StartContext[72] = StartContext + 72;
StartContext[74] = StartContext + 74;
LODWORD(Object) = a1[9];
EtwpCovSampLookasideControlInitialize(
(INT64)StartContext,
(INT64)(StartContext + 34),
(INT64)EtwpCovSampCaptureAllocateApc,
(unsigned int)(3 * Object) >> 2,
Object);
LODWORD(Objectb) = a1[8];
EtwpCovSampLookasideControlInitialize(
(INT64)StartContext,
(INT64)(StartContext + 44),
(INT64)EtwpCovSampCaptureAllocateCaptureBuffer,
(unsigned int)(3 * Objectb) >> 2,
Objectb);
v6 = (unsigned int)a1[19];
if( (_DWORD)v6 )
{
EtwpCovSampStackHashTableAlloc(StartContext + 119, v6);
EtwpCovSampStackHashTableAlloc(StartContext + 120, (unsigned int)a1[19]);
v7 = StartContext[119];
if( !v7 || !StartContext[120] )
goto LABEL_20;
StartContext[118] = v7;
StartContext[121] = (PVOID)(unsigned int)ExGenRandom(0i64);
}
if( StartContext[1] != (PVOID)-1i64 )
goto LABEL_12;
LODWORD(v8) = ExSaAllocate(0x150ui64);
if( v8 == (void *)-1i64 )
{
LABEL_20:
v4 = -1073741670;
goto LABEL_21;
}
StartContext[1] = v8;
LABEL_12:
v9 = (_ETHREAD *)*StartContext;
if( *StartContext )
goto LABEL_15;
v4 = PsCreateSystemThreadEx(
&Handle,
0x1FFFFFui64,
0i64,
0i64,
0i64,
EtwpCovSampCaptureWorkerThread,
StartContext,
0i64,
0i64);
if( v4 < 0 )
{
LABEL_21:
if( StartContext[1] != (PVOID)-1i64 )
EtwpCovSampCaptureFreeLookasides((union SLIST_HEADER *)StartContext);
goto LABEL_30;
}
v30 = 0i64;
ObReferenceObjectByHandle(Handle, 0x1FFFFFu, (POBJECT_TYPE)PsThreadType, 0, &v30, 0i64);
*StartContext = v30;
ThreadInformation[0] = 1;
ThreadInformation[1] = 1;
ThreadInformation[2] = 1;
ZwSetInformationThread(Handle, ThreadHideFromDebugger|0x20, ThreadInformation, 0xCui64);
v9 = (_ETHREAD *)*StartContext;
LABEL_15:
v10 = *a1 & 0x200;
KeSetBasePriorityThread((_KTHREAD *)v9, (unsigned int)(v10 != 0) - 1);
*((_DWORD *)StartContext + 234) = v10 != 0;
MaximumProcessorCount = KeQueryMaximumProcessorCountEx(0xFFFFu);
v12 = MaximumProcessorCount;
v29 = MaximumProcessorCount;
if( MaximumProcessorCount )
{
v28 = 0i64;
v31 = MaximumProcessorCount;
v13 = 0i64;
do
{
v14 = ((unsigned int)StartContext[1] >> 13) & 0x3FFFF;
_BitScanReverse(&v15, v14);
v16 = *(_QWORD *)(v13 + ExSaPageArrays);
v17 = ((unsigned __int64)StartContext[1] >> 4) & 0x1FF;
LODWORD(v28) = v15;
v18 = *(_QWORD *)(*(_QWORD *)(v16 + 8i64 * (v15 - 2)) + 8 * (v14 ^ (unsigned int)(1 << v15)) + 8);
memset(v18 + 8 * (v17 + 1), 0i64);
*(_QWORD *)(v18 + 8 * v17) = 0i64;
EtwpCovSampLookasideInitialize((INT64)StartContext, v18 + 8 * (v17 + 2), (_DWORD *)StartContext + 68);
EtwpCovSampLookasideInitialize((INT64)StartContext, v18 + 8 * (v17 + 10), (_DWORD *)StartContext + 88);
EtwpCovSampStrideSamplerInitialize(v18 + 8 * (v17 + 18), (unsigned int)a1[10], (unsigned int)a1[11]);
EtwpCovSampStrideSamplerInitialize(v18 + 8 * (v17 + 23), (unsigned int)a1[12], (unsigned int)a1[13]);
EtwpCovSampStrideSamplerInitialize(v18 + 8 * (v17 + 28), (unsigned int)a1[14], (unsigned int)a1[15]);
EtwpCovSampStrideSamplerInitialize(v18 + 8 * (v17 + 33), (unsigned int)a1[16], (unsigned int)a1[17]);
v19 = v31-- == 1;
v13 += 8i64;
}
while( !v19 );
v12 = v29;
v5 = (__int64 **)(StartContext + 72);
}
LODWORD(Objecta) = v12 * a1[7];
EtwpCovSampLookasideControlInitialize(
(INT64)StartContext,
(INT64)(StartContext + 54),
(INT64)EtwpCovSampCaptureAllocateSampleBuffer,
(unsigned int)(3 * Objecta) >> 2,
Objecta);
EtwpCovSampLookasideInitialize((INT64)StartContext, (INT64)(StartContext + 64), (_DWORD *)StartContext + 108);
LowPart = KUSER_SHARED_DATA.TickCount.LowPart;
*((_DWORD *)StartContext + 174) = KUSER_SHARED_DATA.TickCount.LowPart;
*((_DWORD *)StartContext + 175) = LowPart;
*((_DWORD *)StartContext + 230) = 0;
*((_DWORD *)StartContext + 232) = a1[18];
*((_DWORD *)StartContext + 233) = a1[6];
_InterlockedExchange((volatile __int32 *)StartContext + 228, 1);
v21 = *v5;
*((_DWORD *)StartContext + 229) = 0;
while( v21 != (__int64 *)v5 )
{
_InterlockedExchange((volatile __int32 *)v21 + 6, 1);
*((_DWORD *)v21 + 7) = 0;
while( 1 )
{
v22 = *((_DWORD *)v21 + 9);
if( v22 >= *(_DWORD *)(v21[2] + 56) || v22 >= *((_DWORD *)v21 + 10) )
break;
v4 = (unsigned int)EtwpCovSampLookasideGrow((INT64)StartContext, (INT64)(v21 - 2));
if( v4 < 0 )
goto LABEL_21;
}
v21 = (__int64 *)*v21;
}
v4 = 0;
LABEL_30:
if( Handle )
ObCloseHandle(Handle, 0);
return(unsigned int)v4;
}Referenced by:
EtwpCoverageSamplerStart