PfTTraceListAdd
VOID __fastcall PfTTraceListAdd(INT64 a1){
__int64 v2;
BOOL v3;
int *v4;
__int64 *v5;
INT64 *v6;
LIST_ENTRY FreeList;
FreeList.Blink = &FreeList;
FreeList.Flink = &FreeList;
ExAcquireFastMutex(&FastMutex);
v2 = (unsigned int)dword_140C4FB1C;
v3 = dword_140C4FB18 < (unsigned int)dword_140C4FB1C;
if( *(_DWORD *)(a1 + 28) == 1 )
{
v5 = qword_140C4FB08;
v2 = (unsigned int)dword_140C4FB24;
v4 = &dword_140C4FB20;
if( dword_140C4FB20 + 1 == dword_140C4FB24 )
++HIDWORD(xmmword_140C4FC10);
}
else
{
v4 = &dword_140C4FB18;
v5 = qword_140C4FAF8;
if( dword_140C4FB18 + 1 == dword_140C4FB1C )
++DWORD2(xmmword_140C4FC10);
dword_140C4FB28 = 1;
}
v6 = (INT64 *)v5[1];
if( (__int64 *)*v6 != v5 )
__fastfail(3u);
*(_QWORD *)a1 = v5;
*(_QWORD *)(a1 + 8) = v6;
*v6 = a1;
v5[1] = a1;
if( ++*v4 > (unsigned int)v2 )
PfTTraceListTrim(*(_DWORD *)(a1 + 28), v2, (__int64)&FreeList);
if( v5 == qword_140C4FAF8 && (__int64 *)*v5 == v5 )
dword_140C4FB28 = 0;
if( v3 && dword_140C4FB18 >= (unsigned int)dword_140C4FB1C )
PfTAccessTracingCleanup((__int64)&PfTGlobals, v2, 2);
KeSetEvent(qword_140C4FB68, 0);
KeReleaseGuardedMutex(&FastMutex);
PfTTraceListFree(&FreeList);
}Referenced by:
PfTGenerateTrace
PfpSectInfoHandleFullBuffer