KiTrackSystemCallEntry

INT64 __fastcall KiTrackSystemCallEntry(PVOID SysCallAddress, INT64 a2, INT64 a3, INT64 a4){
  int v6; 
  INT64 v8; 
  int v9; 
  int v10; 
  INT64 v11; 
  v6 = a3;
  if( !KeIsTraceCallbackAllowed(*((_BYTE *)KeGetCurrentThread() + 562)) )
    return 0i64;
  v8 = *(_QWORD *)KiSystemServiceTraceCallbackTable;
  if( (*(_BYTE *)(KiSystemServiceTraceCallbackTable + 8) & 1) != 0 && v8 )
    v8 ^= KiSystemServiceTraceCallbackTable;
  v9 = *(_BYTE *)(KiSystemServiceTraceCallbackTable + 8) & 1;
  while( v8 )
  {
    v10 = KiSystemServiceTraceTableCompareFunction((UINT64)SysCallAddress, v8);
    if( v10 >= 0 )
    {
      if( v10 <= 0 )
        break;
      v11 = *(_QWORD *)(v8 + 8);
    }
    else
    {
      v11 = *(_QWORD *)v8;
    }
    if( v9 && v11 )
      v8 ^= v11;
    else
      v8 = v11;
  }
  if( v8 && *(_BYTE *)(v8 + 40) && KiDynamicTraceEnabled )
  {
    _InterlockedIncrement(&KiSystemServiceTraceCallbacksActive);
    if( *(_BYTE *)(v8 + 40) )
      ((void(__fastcall *)(_QWORD, _QWORD, _QWORD, INT64, int, INT64))qword_140CFBBA0)(
        *(_QWORD *)(v8 + 24),
        *(_QWORD *)(v8 + 48),
        *(unsigned int *)(v8 + 32),
        a2,
        v6,
        a4);
    _InterlockedDecrement(&KiSystemServiceTraceCallbacksActive);
  }
  return v8;
}

Referenced by: