EtwTraceTimedEvent
VOID __fastcall EtwTraceTimedEvent(INT16 a1, UINT64 a2, INT64 a3, INT64 a4, INT64 a5, INT64 a6){
unsigned int v7;
bool v8;
unsigned __int64 i;
INT64 v10;
__int64 v11;
UINT64 Flag;
UINT64 v13;
EVENT_DATA_DESCRIPTOR EventData;
INT64 v15;
int v16;
int v17;
v15 = a3;
v16 = a4;
v17 = 0;
v7 = *(_DWORD *)(EtwpHostSiloState + 4224);
v8 = !_BitScanForward((unsigned int *)&a3, v7);
for( i = (unsigned int)a2; !v8; v8 = !_BitScanForward((unsigned int *)&a3, v7) )
{
v7 &= v7 - 1;
v10 = 32 * a3 + EtwpHostSiloState + 4260;
if( v10 )
{
if( ((unsigned int)i & *(_DWORD *)(v10 + 4 * (i >> 29)) & 0x1FFFFFFF) != 0 )
{
v11 = *(unsigned __int8 *)(EtwpHostSiloState + 2 * a3 + 4209);
EventData.Reserved = 0;
EventData.Size = 8;
LODWORD(v13) = a5;
LOWORD(Flag) = a1;
EventData.Ptr = a6 + 8 * (v11 - 1);
EtwpLogKernelEvent(
&EventData,
EtwpHostSiloState,
*(unsigned __int8 *)(EtwpHostSiloState + 2 * a3 + 4208),
2u,
Flag,
v13);
}
}
}
}Referenced by:
EtwTraceCpuCacheFlush
EtwpTraceFltTimedIo
HvcallFastExtended
HvcallInitiateHypercall
IopTimerDispatch
KiProcessExpiredTimerList
PerfInfoLogInterruptHv
PerfInfoLogIpiReceive