EtwpCCSwapStart

NTSTATUS __stdcall EtwpCCSwapStart(UINT64 ClockType){
  unsigned int v1; 
  __int64 v2; 
  int v3; 
  unsigned int v4; 
  __int64 v5; 
  __int64 v6; 
  VOID *PoolWithTag; 
  unsigned int i; 
  __int64 v10; 
  __int64 v11; 
  v1 = KeNumberProcessors_0;
  v2 = (unsigned int)ClockType;
  v3 = *((_DWORD *)CCSwapNumLoggersPerClockType + (unsigned int)ClockType);
  if( v3 || (v4 = 0, !(_DWORD)KeNumberProcessors_0) )
  {
LABEL_7:
    *((_DWORD *)CCSwapNumLoggersPerClockType + v2) = v3 + 1;
    return 0;
  }
  while( 1 )
  {
    KeGetPrcb(v4);
    v6 = *(_QWORD *)(v5 + 33576);
    if( *(_QWORD *)(v6 + 8 * v2 + 296) )
    {
      *(_BYTE *)(v2 + v6 + 288) = 0;
      goto LABEL_5;
    }
    PoolWithTag = ExAllocatePoolWithTag(NonPagedPoolNx, 0x400ui64, 0x77734343ui64);
    *(_QWORD *)(v6 + 8 * v2 + 296) = PoolWithTag;
    if( !PoolWithTag )
      break;
LABEL_5:
    ++v4;
    **(_DWORD **)(v6 + 8 * v2 + 296) = 0;
    if( v4 >= v1 )
    {
      v3 = *((_DWORD *)CCSwapNumLoggersPerClockType + v2);
      goto LABEL_7;
    }
  }
  for( i = 0; i < v4; ++i )
  {
    KeGetPrcb(i);
    v11 = *(_QWORD *)(v10 + 33576);
    ExFreePoolWithTag(*(PVOID *)(v11 + 8 * v2 + 296), 0);
    *(_QWORD *)(v11 + 8 * v2 + 296) = 0i64;
  }
  return -1073741801;
}

Referenced by: