EtwpCCSwapTrace

struct _KPRCB *__fastcall EtwpCCSwapTrace(__int64 a1, __int64 a2, unsigned int a3, struct _KPRCB **a4){
  struct _KPRCB *result; 
  unsigned int v5; 
  __int64 v8; 
  __int64 v9; 
  unsigned int *v10; 
  struct _KPRCB *v11; 
  _DWORD *v12; 
  __int64 v13; 
  unsigned int v14; 
  unsigned int v15; 
  char v16; 
  unsigned int v17; 
  int v18; 
  char v19; 
  int v20; 
  unsigned int v21; 
  char v22; 
  unsigned int v23; 
  struct _KPRCB *v24; 
  unsigned int v25; 
  unsigned int LowPart; 
  __int64 Src; 
  result = KeGetCurrentPrcb();
  v5 = 0;
  Src = 0i64;
  v8 = a3;
  v9 = *((_QWORD *)result + 4197);
  v10 = *(unsigned int **)(v9 + 8i64 * a3 + 296);
  if( v10 )
  {
    v11 = *a4;
    v12 = v10 + 6;
    if( *v10 )
    {
      v13 = (__int64)v11 - *((_QWORD *)v10 + 1);
    }
    else
    {
      LowPart = KUSER_SHARED_DATA.TickCount.LowPart;
      *((_QWORD *)v10 + 1) = v11;
      *((_QWORD *)v10 + 2) = v11;
      v10[1] = LowPart;
      *v10 = 104;
      memset((INT64)(v10 + 6), 0i64);
      v13 = 0i64;
    }
    v14 = *(_DWORD *)(a1 + 1152);
    v15 = 0;
    if( v14 )
    {
      while( *v12 != v14 )
      {
        if( !*v12 )
        {
          v10[v15 + 6] = v14;
          *((_BYTE *)v10 + v15 + 88) = *(_BYTE *)(a1 + 563);
          break;
        }
        ++v15;
        ++v12;
        if( v15 >= 0x10 )
          break;
      }
    }
    if( v15 == 16
      || KUSER_SHARED_DATA.TickCount.LowPart - v10[1] > 0x1F4
      || (unsigned __int64)*v10 + 8 > 0x400
      || v13 > 0x40000000
      || *(_BYTE *)(v9 + v8 + 288) )
    {
      EtwpCCSwapFlush();
      v24 = *a4;
      v25 = KUSER_SHARED_DATA.TickCount.LowPart;
      *((_QWORD *)v10 + 1) = *a4;
      *((_QWORD *)v10 + 2) = v24;
      v10[1] = v25;
      *v10 = 104;
      memset((INT64)(v10 + 6), 0i64);
      *(_BYTE *)(v9 + v8 + 288) = 0;
      v13 = 0i64;
      v10[6] = v14;
      v15 = 0;
    }
    if( v14 )
    {
      if( *(_DWORD *)(a2 + 1152) )
        v5 = KUSER_SHARED_DATA.TickCount.LowPart - *(_DWORD *)(a2 + 436);
      v16 = *(_BYTE *)(a1 + 195);
      v17 = v16 - *((char *)v10 + v15 + 88);
      if( v5 > 1 || v17 > 7 || v13 >= 0x20000 )
      {
        LODWORD(Src) = (4 * v13) | 3;
        if( v5 >= 0x1FFFF )
          v5 = 0x1FFFF;
        v22 = *(_BYTE *)(a1 + 388);
        HIDWORD(Src) = (WORD2(Src) ^ ((unsigned __int8)v15 ^ BYTE4(Src)) & 0xF) & 0x3FF | (((32 * v5) | v16 & 0x1F) << 10);
        if( v22 == 5 )
          v23 = (WORD2(Src) ^ (unsigned __int16)(16 * *(unsigned __int8 *)(a1 + 643))) & 0x3F0 ^ HIDWORD(Src);
        else
          v23 = (16 * *(unsigned __int8 *)(a1 + 388) - 369) & 0x3F0 | HIDWORD(Src) & 0xFFFFFC0F;
        HIDWORD(Src) = v23;
        v21 = 8;
      }
      else
      {
        v18 = v17 & 7 | ((_DWORD)v13 << 9);
        v19 = *(_BYTE *)(a1 + 388);
        LODWORD(Src) = (4 * (v15 & 0xF | (16 * v18))) | 2;
        if( v19 == 5 )
          v20 = ((unsigned __int16)Src ^ (unsigned __int16)(*(unsigned __int8 *)(a1 + 643) << 9)) & 0x7E00 ^ Src;
        else
          v20 = ((*(unsigned __int8 *)(a1 + 388) << 9) - 11777) & 0x7E00 | Src & 0xFFFF81FF;
        LODWORD(Src) = v20;
        v21 = 4;
      }
    }
    else if( v13 >= 0x4000 )
    {
      v21 = 4;
      LODWORD(Src) = (4 * v13) | 1;
    }
    else
    {
      v21 = 2;
      LOWORD(Src) = 4 * v13;
    }
    memmove((UINT8 *)v10 + *v10, (UINT8 *)&Src, v21);
    *v10 += v21;
    result = *a4;
    *((_QWORD *)v10 + 1) = *a4;
  }
  return result;
}

Referenced by: