IopProcessIoTracking

VOID __stdcall IopProcessIoTracking(UINT64 ElapsedTime, UINT64 DeviceType){
  char v2; 
  _ETHREAD *CurrentThread; 
  _ETHREAD *v4; 
  __int64 v5; 
  unsigned __int8 v6; 
  __int64 v7; 
  __int64 v8; 
  int SessionId; 
  bool v10; 
  __int64 i; 
  unsigned int v12; 
  _QWORD v13[3]; 
  v13[0] = 24i64;
  v2 = 0;
  v13[1] = ElapsedTime;
  v13[2] = (unsigned int)DeviceType;
  if( KeGetCurrentIrql() < 2u )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 243);
    v2 = 1;
  }
  v12 = 0;
  v4 = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)v4 + 243);
  if( ++*((_BYTE *)v4 + 794) != 1 )
  {
    v5 = 0i64;
    goto LABEL_5;
  }
  v6 = *((_BYTE *)v4 + 792);
  if( !v6 )
  {
    if( !*((_BYTE *)v4 + 870) )
    {
      v5 = 0i64;
      goto LABEL_5;
    }
    v7 = *((unsigned __int8 *)v4 + 870);
    *((_BYTE *)v4 + 870) = 0;
    v6 = v7 | *((_BYTE *)v4 + 792);
  }
  _BitScanForward((unsigned int *)&v8, v6);
  *((_BYTE *)v4 + 792) = v6 & ~(1 << v8);
  v5 = *((_QWORD *)v4 + 100) + 96 * v8;
  if( !v5 )
  {
LABEL_5:
    _interlockedbittestandset((volatile signed __int32 *)v4 + 30, 0x10u);
    goto LABEL_16;
  }
  if( (unsigned __int64)&IopPerfIoTrackingLock >= 0xFFFF800000000000ui64
    && *((_BYTE *)&antNameB + (((unsigned __int64)&IopPerfIoTrackingLock >> 39) & 0x1FF) - 256) == 1 )
  {
    SessionId = MmGetSessionIdEx(*((_QWORD *)v4 + 23));
  }
  else
  {
    SessionId = -1;
  }
  *(_DWORD *)(v5 + 40) = SessionId;
  *(_QWORD *)(v5 + 32) = (unsigned __int64)&IopPerfIoTrackingLock & 0x7FFFFFFFFFFFFFFCi64;
LABEL_16:
  --*((_BYTE *)v4 + 794);
  KiAbThreadRemoveBoosts((ULONG_PTR)v4, (__int64)&IopPerfIoTrackingLock, &v12);
  v10 = (*((_WORD *)v4 + 243))++ == 0xFFFF;
  if( v10 && *((_ETHREAD **)v4 + 19) != (_ETHREAD *)((char *)v4 + 152) )
    KiCheckForKernelApcDelivery();
  if( !_InterlockedCompareExchange64((volatile signed __int64 *)&IopPerfIoTrackingLock, 17i64, 0i64)
    || ExfTryAcquirePushLockShared(&IopPerfIoTrackingLock) )
  {
    if( v5 )
      *(_BYTE *)(v5 + 26) |= 1u;
    for( i = IopPerfIoTrackingListHead; (__int64 *)i != &IopPerfIoTrackingListHead; i = *(_QWORD *)i )
      (*(void(__fastcall **)(_QWORD *))(i + 16))(v13);
    if( _InterlockedCompareExchange64((volatile signed __int64 *)&IopPerfIoTrackingLock, 0i64, 17i64) != 17 )
      ExfReleasePushLockShared((INT64 *)&IopPerfIoTrackingLock);
    KeAbPostRelease(&IopPerfIoTrackingLock);
  }
  else if( v5 )
  {
    KeAbPostReleaseEx(&IopPerfIoTrackingLock, (PVOID)v5);
  }
  if( v2 == 1 )
    KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
}

Referenced by: