EtwpCoverageSamplerQuery
NTSTATUS __stdcall EtwpCoverageSamplerQuery(PVOID BugCheckParameter2){
__int64 v1;
unsigned int v2;
unsigned int *v3;
INT64 v5;
char *v6;
unsigned int v7;
INT64 *v8;
NTSTATUS v9;
_ETHREAD *CurrentThread;
unsigned int v11;
char *v12;
unsigned __int64 v13;
unsigned int v14;
unsigned int v15;
unsigned int v16;
int v17;
_ETHREAD *v18;
char *v19;
__int128 **v20;
char *v21;
unsigned int v22;
unsigned int v23;
unsigned int v24;
unsigned int v25;
unsigned int v26;
unsigned int v27;
__int128 *v28;
unsigned __int64 v29;
int v30;
unsigned int v31;
unsigned int v32;
unsigned int v33;
unsigned int v34;
unsigned int v35;
unsigned int v36;
INT64 *PoolWithTag;
__int64 v38;
INT64 v39;
__int64 v40;
__int64 v41;
__int64 v42;
__int64 v43;
_OWORD *v44;
_OWORD *v45;
_OWORD *v46;
__int64 v47;
__int64 v48;
_DWORD *v49;
unsigned __int64 v50;
char *i;
unsigned int v52;
_DWORD *v53;
__int64 v54;
INT64 v55;
unsigned __int64 v56;
UINT8 *v57;
int v58;
unsigned int v59;
__int64 v60;
_DWORD *v61;
unsigned int v62;
_OWORD *v63;
char *v64;
char *v65;
char **v66;
unsigned int j;
int v69;
unsigned int v70;
unsigned int v71;
char *v72;
unsigned __int64 v73;
unsigned int v74;
unsigned int v75;
unsigned int v76;
unsigned int v77;
INT64 *v78;
__int128 v79;
NTSTRSAFE_PWSTR pszDest;
PVOID a1;
unsigned int v82;
unsigned int v83;
unsigned int v84;
unsigned __int64 v85;
INT64 v86;
_DWORD *v87;
unsigned __int64 v88;
__int64 v89;
_OWORD *v90;
unsigned int *v91;
__int64 v92;
PVOID v93;
unsigned int v94;
__int64 v95;
unsigned __int64 v96;
_DWORD *v97;
wchar_t *v98;
char *v99;
__int64 v100;
__int64 v101;
unsigned __int64 v102;
_DWORD *v103;
_ETHREAD *v104;
_ETHREAD *v105;
_ETHREAD *v106;
_DWORD a2[4];
__int128 v108;
v91 = v3;
v83 = v2;
v100 = v1;
v93 = BugCheckParameter2;
a1 = 0i64;
v5 = StartContext;
v86 = StartContext;
v6 = (char *)BugCheckParameter2 + 16;
v92 = (__int64)BugCheckParameter2 + 16;
v73 = 0i64;
v89 = 0i64;
v79 = 0i64;
v7 = 0;
v8 = 0i64;
v78 = 0i64;
v90 = 0i64;
v9 = EtwpCovSampAcquireSamplerRundown(&a1);
if( v9 >= 0 )
{
if( a1 == BugCheckParameter2 )
{
EtwpCovSampCaptureFlush(v5);
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
ExAcquirePushLockExclusiveEx((UINT64)BugCheckParameter2, 0i64);
*((_QWORD *)BugCheckParameter2 + 1) = KeGetCurrentThread();
v11 = 0;
v12 = (char *)*((_QWORD *)BugCheckParameter2 + 146);
v72 = v12;
while( v12 != (char *)BugCheckParameter2 + 1168 )
{
v11 += *((_DWORD *)v12 + 4);
v12 = *(char **)v12;
}
v72 = v12;
v76 = v11;
v13 = 8i64 * v11;
v96 = v13;
v14 = -1;
v15 = -1;
if( v13 <= 0xFFFFFFFF )
v15 = v13;
v94 = v15;
v9 = v13 > 0xFFFFFFFF ? 0xC0000095 : 0;
if( v13 <= 0xFFFFFFFF )
{
v16 = v15 + 716;
if( v15 + 716 >= v15 )
v14 = v15 + 716;
v82 = v14;
v71 = v14;
v9 = v16 < v15 ? 0xC0000095 : 0;
if( v16 >= v15 )
{
v17 = 0;
v69 = 0;
v70 = 0;
v75 = 0;
v74 = 0;
*((_QWORD *)&v79 + 1) = &v79;
*(_QWORD *)&v79 = &v79;
v18 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v18 + 242);
ExAcquirePushLockSharedEx((UINT64)(v6 + 664), 0i64);
v19 = (char *)*((_QWORD *)v6 + 89);
v72 = v19;
LABEL_14:
v20 = (__int128 **)*((_QWORD *)&v79 + 1);
while( 1 )
{
v21 = v19;
if( v19 == v6 + 712 )
break;
v19 = *(char **)v19;
v72 = v19;
if( *((_DWORD *)v21 + 15) || (*((_DWORD *)v21 + 12) & 0x100000) != 0 )
{
if( !*((_QWORD *)v21 + 4) )
{
if( *((_QWORD *)v21 - 1) == 1i64 )
_InterlockedIncrement((volatile signed __int32 *)v6 + 281);
_InterlockedExchange((volatile __int32 *)v21 + 15, 0);
v19 = v72;
goto LABEL_14;
}
v69 = v17 + 1;
++v70;
v22 = 2 * (unsigned __int16)*((_DWORD *)v21 + 12) + 2;
v23 = v22 + v75;
v24 = -1;
if( v22 + v75 >= v22 )
v24 = v22 + v75;
v75 = v24;
v9 = v23 < v22 ? 0xC0000095 : 0;
if( v23 < v22 )
goto LABEL_86;
v25 = *((_DWORD *)v21 - 4) - (((unsigned __int8)*((_DWORD *)v21 - 4) - 1) & 3) + 3;
v26 = v25 + v74;
v27 = -1;
if( v25 + v74 >= v25 )
v27 = v25 + v74;
v74 = v27;
v9 = v26 < v25 ? 0xC0000095 : 0;
if( v26 < v25 )
goto LABEL_86;
v28 = (__int128 *)(v21 + 72);
if( *v20 != &v79 )
LABEL_82:
__fastfail(3u);
*(_QWORD *)v28 = &v79;
*((_QWORD *)v28 + 1) = v20;
*v20 = v28;
v20 = (__int128 **)v28;
*((_QWORD *)&v79 + 1) = v28;
v17 = v69;
}
}
if( _InterlockedCompareExchange64((volatile signed __int64 *)v6 + 83, 0i64, 17i64) != 17 )
ExfReleasePushLockShared((INT64 *)v6 + 83);
KeAbPostRelease(v6 + 664);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
v29 = 48i64 * v70;
v30 = -1;
if( v29 <= 0xFFFFFFFF )
v30 = 48 * v70;
v94 = v30;
v9 = v29 > 0xFFFFFFFF ? 0xC0000095 : 0;
if( v29 <= 0xFFFFFFFF )
{
v31 = v30 + v71;
v32 = -1;
if( v31 >= v71 )
v32 = v31;
v71 = v32;
v9 = v31 < v82 ? 0xC0000095 : 0;
if( v31 >= v82 )
{
v33 = v32 + v75;
v34 = -1;
if( v32 + v75 >= v32 )
v34 = v32 + v75;
v71 = v34;
v9 = v33 < v32 ? 0xC0000095 : 0;
if( v33 >= v32 )
{
v35 = v34 + v74;
v36 = -1;
if( v34 + v74 >= v34 )
v36 = v34 + v74;
v71 = v36;
v9 = v35 < v34 ? 0xC0000095 : 0;
if( v35 >= v34 )
{
v7 = v69;
if( v83 < v36 )
{
*v91 = v36;
v9 = -1073741789;
goto LABEL_87;
}
if( v69 )
{
PoolWithTag = (INT64 *)ExAllocatePoolWithTag(PagedPool, (unsigned int)(8 * v69), 0x56777445ui64);
v8 = PoolWithTag;
v78 = PoolWithTag;
if( !PoolWithTag )
{
v9 = -1073741670;
goto LABEL_87;
}
memset((INT64)PoolWithTag, 0i64);
}
v38 = v100;
if( (*(_DWORD *)(v100 + 16) & 1) != 0 )
{
v39 = v86;
v40 = *(_QWORD *)(v86 + 952);
if( v40 )
{
v95 = *(_QWORD *)(v86 + 952);
memset(v40 + 8, 0i64);
}
v41 = *(_QWORD *)(v39 + 960);
if( v41 )
{
v95 = *(_QWORD *)(v39 + 960);
memset(v41 + 8, 0i64);
}
}
v42 = v38 + 20;
v89 = v42;
v43 = v38 + 64;
v73 = v43;
*(_OWORD *)v42 = 0i64;
*(_OWORD *)(v42 + 16) = 0i64;
*(_QWORD *)(v42 + 32) = 0i64;
*(_DWORD *)(v42 + 40) = 0;
*(_DWORD *)v42 = 44;
*(_DWORD *)(v42 + 8) = *((_DWORD *)BugCheckParameter2 + 303);
*(_DWORD *)(v42 + 16) = 592;
*(_DWORD *)(v42 + 12) = 44;
v44 = (_OWORD *)v43;
v101 = v43;
v45 = (_OWORD *)(v43 + 592);
v73 = (unsigned __int64)v45;
v46 = v6 + 8;
v47 = 4i64;
do
{
*v44 = *v46;
v44[1] = v46[1];
v44[2] = v46[2];
v44[3] = v46[3];
v44[4] = v46[4];
v44[5] = v46[5];
v44[6] = v46[6];
v44 += 8;
*(v44 - 1) = v46[7];
v46 += 8;
--v47;
}
while( v47 );
*v44 = *v46;
v44[1] = v46[1];
v44[2] = v46[2];
v44[3] = v46[3];
v44[4] = v46[4];
*(_DWORD *)(v42 + 24) = 60;
*(_DWORD *)(v42 + 20) = (_DWORD)v45 - v42;
v90 = v45;
v48 = (__int64)v45 + 60;
*(_DWORD *)(v42 + 32) = v76;
*(_DWORD *)(v42 + 28) = v48 - v42;
v49 = (_DWORD *)v48;
v97 = (_DWORD *)v48;
v50 = v96 + v48;
v73 = v50;
v102 = v50;
for( i = (char *)*((_QWORD *)BugCheckParameter2 + 146); ; i = *(char **)i )
{
v72 = i;
if( i == (char *)BugCheckParameter2 + 1168 )
break;
v99 = i;
v52 = 0;
v84 = 0;
while( v52 < *((_DWORD *)i + 5) )
{
v53 = (_DWORD *)(*((_QWORD *)i + 3) + 8i64 * v52);
v103 = v53;
if( *(_QWORD *)v53 )
{
if( (unsigned __int64)v49 >= v50 )
break;
*v49 = *v53;
v49[1] = v53[1];
v49 += 2;
v97 = v49;
}
v84 = ++v52;
}
}
v54 = v70;
*(_DWORD *)(v42 + 40) = v70;
*(_DWORD *)(v42 + 36) = v50 - v42;
v55 = v50;
v87 = (_DWORD *)v50;
v56 = 48 * v54 + v50;
memset(v55, 0i64);
v57 = (UINT8 *)v56;
v85 = v56;
v98 = (wchar_t *)(v74 + v56);
v58 = v74 + v56;
pszDest = v98;
v59 = v75 + (_DWORD)v98;
v73 = (unsigned __int64)v98 + v75;
v88 = v73;
v77 = 0;
v60 = v79;
v72 = (char *)v79;
while( (__int128 *)v60 != &v79 )
{
v72 = *(char **)v60;
v61 = v87;
v87[2] = (_DWORD)v57 - v42;
v61[3] = *(_DWORD *)(v60 - 88);
*v61 = v58 - v42;
v61[1] = (unsigned __int16)*(_DWORD *)(v60 - 24);
v61[4] = *(_DWORD *)(v60 - 108);
v61[5] = *(_DWORD *)(v60 - 112);
v61[6] = *(_DWORD *)(v60 - 104);
v61[7] = *(_DWORD *)(v60 - 20);
v61[8] = *(_DWORD *)(v60 - 16);
v61[9] = *(_DWORD *)(v60 + 16);
v61[10] = *(_DWORD *)(v60 + 20);
v61[11] = *(_DWORD *)(v60 + 24);
v87 = v61 + 12;
memmove(v57, *(UINT8 **)(v60 - 96), *(unsigned int *)(v60 - 88));
v85 = (*(unsigned int *)(v60 - 88) + v85 + 3) & 0xFFFFFFFFFFFFFFFCui64;
if( v85 > (unsigned __int64)v98 )
break;
RtlStringCchCopyNW(
pszDest,
(__int64)(v88 - (_QWORD)pszDest) >> 1,
*(const WCHAR **)(v60 - 32),
(unsigned __int16)*(_DWORD *)(v60 - 24));
pszDest += (unsigned int)(unsigned __int16)*(_DWORD *)(v60 - 24) + 1;
if( (unsigned __int64)pszDest > v88 )
break;
v104 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v104 + 242);
ExAcquirePushLockExclusiveEx((UINT64)(v6 + 664), 0i64);
v105 = (_ETHREAD *)KeGetCurrentThread();
*((_QWORD *)v6 + 84) = v105;
v62 = v77;
v78[v77] = *(_QWORD *)(v60 - 40);
v77 = v62 + 1;
*(_QWORD *)(v60 - 40) = 0i64;
*(_QWORD *)(v60 - 32) = 0i64;
*(_DWORD *)(v60 - 24) &= 0xFFFF0000;
*(_DWORD *)(v60 - 24) |= 0x80000u;
*((_QWORD *)v6 + 84) = 0i64;
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v6 + 83, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)v6 + 83);
KeAbPostRelease(v6 + 664);
v106 = (_ETHREAD *)KeGetCurrentThread();
KeLeaveCriticalRegionThread((__int64)v106);
--v70;
if( *(_QWORD *)(v60 - 80) == 1i64 )
_InterlockedIncrement((volatile signed __int32 *)v6 + 281);
_InterlockedExchange((volatile __int32 *)(v60 - 12), 0);
v59 = v73;
v42 = v89;
v60 = (__int64)v72;
v58 = (int)pszDest;
v57 = (UINT8 *)v85;
}
v63 = v90;
*v90 = *(_OWORD *)(v6 + 600);
v63[1] = *(_OWORD *)(v6 + 616);
v63[2] = *(_OWORD *)(v6 + 632);
*((_QWORD *)v63 + 6) = *((_QWORD *)v6 + 81);
*((_DWORD *)v63 + 14) = *((_DWORD *)v6 + 164);
*(_OWORD *)(v6 + 600) = 0i64;
*(_OWORD *)(v6 + 616) = 0i64;
*(_OWORD *)(v6 + 632) = 0i64;
*((_QWORD *)v6 + 81) = 0i64;
*((_DWORD *)v6 + 164) = 0;
*(_OWORD *)a2 = 0i64;
v108 = 0i64;
EtwpCovSampCaptureFlushStats(v86, a2);
*((_DWORD *)v63 + 7) = a2[0];
*((_DWORD *)v63 + 8) = a2[1];
*((_DWORD *)v63 + 9) = a2[2];
*((_DWORD *)v63 + 10) = a2[3];
*(_OWORD *)((char *)v63 + 44) = v108;
*(_DWORD *)(v42 + 4) = v59 - v42;
v64 = (char *)*((_QWORD *)BugCheckParameter2 + 146);
v72 = v64;
while( v64 != (char *)BugCheckParameter2 + 1168 )
{
v65 = v64;
v99 = v64;
v64 = *(char **)v64;
v72 = v64;
if( v65 == *((char **)BugCheckParameter2 + 144) )
{
memset(*((_QWORD *)v65 + 3), 0i64);
*((_DWORD *)v65 + 4) = 0;
}
else
{
v66 = (char **)*((_QWORD *)v65 + 1);
if( *((char **)v64 + 1) != v65 || *v66 != v65 )
goto LABEL_82;
*v66 = v64;
*((_QWORD *)v64 + 1) = v66;
--*((_DWORD *)BugCheckParameter2 + 296);
EtwpCoverageSamplerFreeTable(v65);
}
}
++*((_DWORD *)BugCheckParameter2 + 303);
EtwpCovSampCaptureContextSetPaused((INT64)BugCheckParameter2, v86, 0i64);
*((_QWORD *)BugCheckParameter2 + 1) = 0i64;
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)BugCheckParameter2, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)BugCheckParameter2);
KeAbPostRelease(BugCheckParameter2);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
EtwpCovSampContextPruneModules((INT64)v6);
*v91 = v71;
v9 = 0;
v8 = v78;
}
}
}
}
LABEL_86:
v7 = v69;
}
}
}
else
{
v9 = -1073741431;
}
}
LABEL_87:
if( *((struct _KTHREAD **)v6 + 84) == KeGetCurrentThread() )
{
*((_QWORD *)v6 + 84) = 0i64;
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v6 + 83, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)v6 + 83);
KeAbPostRelease(v6 + 664);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
}
if( *((struct _KTHREAD **)BugCheckParameter2 + 1) == KeGetCurrentThread() )
{
*((_QWORD *)BugCheckParameter2 + 1) = 0i64;
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)BugCheckParameter2, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)BugCheckParameter2);
KeAbPostRelease(BugCheckParameter2);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
}
if( v8 )
{
for( j = 0; j < v7; ++j )
EtwpCovSampModuleNameInfoCleanup(&v8[j]);
ExFreePoolWithTag(v8, 0x56777445u);
}
if( a1 )
{
ExReleaseRundownProtection((PEX_RUNDOWN_REF)&stru_140C196C0);
KeLeaveCriticalRegion();
}
return v9;
}Referenced by:
EtwpQueryCoverageSamplerInformation