EtwpProcessorRundown

VOID __stdcall EtwpProcessorRundown(UINT64 LoggerId, UINT8 Start){
  struct _PROCESSOR_NUMBER *PoolWithTag; 
  unsigned int ActiveProcessorCount; 
  unsigned int v5; 
  ULONG v6; 
  UINT64 v7; 
  UINT64 v8; 
  USHORT ActiveGroupCount; 
  unsigned int v10; 
  unsigned int v11; 
  KAFFINITY *v12; 
  KAFFINITY GroupAffinity; 
  UINT64 v14; 
  UINT64 v15; 
  INT64 v16; 
  INT64 v17; 
  unsigned __int16 v18; 
  bool v19; 
  int v20; 
  UINT64 v21; 
  UINT64 v22; 
  UINT64 Flag; 
  UINT64 Flaga; 
  UINT64 v25; 
  UINT64 v26; 
  unsigned int v27; 
  unsigned int v28; 
  int v29; 
  _OWORD P[64]; 
  EVENT_DATA_DESCRIPTOR EventData; 
  struct _PROCESSOR_NUMBER *v32; 
  int v33; 
  int v34; 
  memset((INT64)P, 0i64);
  PoolWithTag = (struct _PROCESSOR_NUMBER *)P;
  ActiveProcessorCount = KeQueryActiveProcessorCountEx(0xFFFFu);
  v5 = 0;
  v27 = ActiveProcessorCount;
  if( ActiveProcessorCount > 0x20 )
  {
    PoolWithTag = (struct _PROCESSOR_NUMBER *)ExAllocatePoolWithTag(
                                                PagedPool,
                                                4i64 * ActiveProcessorCount,
                                                0x74777445ui64);
    if( !PoolWithTag )
      goto LABEL_8;
    ActiveProcessorCount = v27;
  }
  v6 = 0;
  if( ActiveProcessorCount )
  {
    do
    {
      KeGetProcessorNumberFromIndex(v6, &PoolWithTag[v6]);
      ActiveProcessorCount = v27;
      ++v6;
    }
    while( v6 < v27 );
  }
  v7 = *(unsigned int *)LoggerId;
  v8 = *(_QWORD *)(LoggerId + 1080);
  v33 = 4 * ActiveProcessorCount;
  EventData.Ptr = (unsigned __int64)&v27;
  LODWORD(v25) = 4200450;
  LOWORD(Flag) = 2843;
  *(_QWORD *)&EventData.Size = 4i64;
  v32 = PoolWithTag;
  v34 = 0;
  EtwpLogKernelEvent(&EventData, v8, v7, 2u, Flag, v25);
  if( PoolWithTag != (struct _PROCESSOR_NUMBER *)P )
    ExFreePoolWithTag(PoolWithTag, 0);
LABEL_8:
  ActiveGroupCount = KeQueryActiveGroupCount();
  v10 = ActiveGroupCount;
  v11 = 0;
  v29 = ActiveGroupCount;
  if( ActiveGroupCount )
  {
    v12 = (KAFFINITY *)P;
    do
    {
      GroupAffinity = KeQueryGroupAffinity(v11++);
      *v12++ = GroupAffinity;
    }
    while( v11 < v10 );
  }
  v14 = *(unsigned int *)LoggerId;
  v15 = *(_QWORD *)(LoggerId + 1080);
  EventData.Ptr = (unsigned __int64)&v29;
  LODWORD(v25) = 4200450;
  v32 = (struct _PROCESSOR_NUMBER *)P;
  v33 = 8 * v10;
  LOWORD(Flag) = 2842;
  *(_QWORD *)&EventData.Size = 4i64;
  v34 = 0;
  EtwpLogKernelEvent(&EventData, v15, v14, 2u, Flag, v25);
  KeQueryHighestNodeNumber(v17, v16);
  v19 = v18 == -1;
  v20 = v18 + 1;
  v28 = v20;
  if( !v19 )
  {
    do
    {
      KeQueryNodeActiveAffinity(v5, (PGROUP_AFFINITY)&P[v5], 0i64);
      v20 = v28;
      ++v5;
    }
    while( v5 < v28 );
  }
  v21 = *(unsigned int *)LoggerId;
  v22 = *(_QWORD *)(LoggerId + 1080);
  v33 = 16 * v20;
  EventData.Ptr = (unsigned __int64)&v28;
  LODWORD(v26) = 4200450;
  LOWORD(Flaga) = 2840;
  EtwpLogKernelEvent(&EventData, v22, v21, 2u, Flaga, v26);
}

Referenced by: