KiProcessProfileList
VOID __stdcall KiProcessProfileList(_KTRAP_FRAME *TrFrame, _KPROFILE_SOURCE Source, _LIST_ENTRY *ListHead){
struct _KPRCB *CurrentPrcb;
_LIST_ENTRY *i;
unsigned __int64 v8;
unsigned __int64 Rip;
_LIST_ENTRY *Blink;
CurrentPrcb = KeGetCurrentPrcb();
for( i = ListHead->Flink; i != ListHead; i = i->Flink )
{
if( SLOWORD(i[14].Blink) == Source )
{
if( LOWORD(i[-1].Blink) == 17 )
{
((void(__fastcall *)(_KTRAP_FRAME *, _LIST_ENTRY *))i[1].Blink)(TrFrame, i[2].Flink);
}
else
{
v8 = (unsigned int)KiProcessorIndexToNumberMappingTable[*((unsigned int *)CurrentPrcb + 9)];
if( ((*((_QWORD *)&i[4].Blink + (v8 >> 6)) >> (v8 & 0x3F)) & 1) != 0 )
{
Rip = TrFrame->Rip;
Blink = i[1].Blink;
if( Rip >= (unsigned __int64)Blink && (_LIST_ENTRY *)Rip < i[2].Flink )
_InterlockedIncrement((volatile signed __int32 *)((char *)i[3].Flink
+ (((Rip - (unsigned __int64)Blink) >> LODWORD(i[2].Blink)) & 0xFFFFFFFC)));
}
}
}
}
}Referenced by:
KeProfileInterruptWithSource