PfTLoggingWorker
VOID __fastcall PfTLoggingWorker(PVOID StartContext){
UINT64 v2;
UINT8 v3;
UINT8 v4;
int v5;
int v6;
int v7;
int v8;
unsigned int v9;
unsigned __int8 v10;
int v11;
int v12;
int v13;
unsigned int v14;
unsigned __int8 v15;
int v16;
int v17;
IRP *WaitMode;
union _LARGE_INTEGER Interval;
union _LARGE_INTEGER Timeout;
PVOID Object[4];
struct _KWAIT_BLOCK WaitBlockArray;
Interval.QuadPart = -300000i64;
Timeout.QuadPart = -3000000000i64;
KeSetBasePriorityThread(KeGetCurrentThread(), 0xFFFFFFFFi64);
Object[0] = (char *)StartContext + 96;
Object[1] = (char *)StartContext + 32;
Object[2] = (char *)StartContext + 8;
Object[3] = &Event;
qword_140C4F9C0 = KiQueryUnbiasedInterruptTime(1u);
while( 1 )
{
do
{
KeWaitForMultipleObjects((_BYTE *)4, Object, WaitAny, Executive, 0, 0, &Timeout, &WaitBlockArray);
v6 = v5;
if( v5 == 258 )
v6 = 3;
}
while( v6 >= 4 );
KeResetEvent(Object[v6], v2, v3, v4, WaitMode);
if( !v6 )
break;
if( dword_140C4FB18 >= (unsigned int)dword_140C4FB1C )
{
if( v6 == 1 )
goto LABEL_31;
}
else
{
v7 = v6 - 1;
if( v7 )
{
v8 = v7 - 1;
if( v8 )
{
if( v8 == 1 )
{
v9 = 0;
while( 1 )
{
v10 = PfpFlushBuffers();
v11 = v10;
if( !v10 && (unsigned int)PfTGenerateTrace() == -1073741670 )
break;
++v9;
if( v11 || v9 >= 0x3E8 )
goto LABEL_13;
}
KeDelayExecutionThread(0, 0, &Interval);
LABEL_13:
if( KiQueryUnbiasedInterruptTime(1u) - qword_140C4F9C0 > 0xB2D05E00 )
PfTGenerateTrace();
}
}
else
{
v12 = (unsigned __int8)PfpFlushBuffers();
v13 = PfTGenerateTrace();
if( !v12 )
{
if( v13 == -1073741670 )
KeDelayExecutionThread(0, 0, &Interval);
PfpFlushBuffers();
}
}
}
else
{
v14 = 0;
do
{
v15 = PfpFlushBuffers();
v16 = v15;
if( (!v15 || *((_DWORD *)StartContext + 20)) && (unsigned int)PfTGenerateTrace() == -1073741670 )
{
KeDelayExecutionThread(0, 0, &Interval);
v17 = 1000;
}
else
{
v17 = 1;
}
v14 += v17;
}
while( !v16 && v14 < 0x2710 );
LABEL_31:
KeSetEvent((PRKEVENT)((char *)StartContext + 56), 0);
}
}
}
}Referenced by:
No references.