EtwpInitializeStackTracing
VOID __stdcall EtwpInitializeStackTracing(_ETW_STACK_TRACE_BLOCK *StackTraceBlock, UINT64 ProcessorIndex){
_SLIST_HEADER *p_ProcessorHistory;
unsigned int v4;
unsigned int v5;
VOID **PoolWithTag;
__int64 i;
VOID **v8;
unsigned __int64 v9;
void *DeferredContext;
p_ProcessorHistory = (_SLIST_HEADER *)&StackTraceBlock[7].StackWalkDpc.ProcessorHistory;
InitializeSListHead((PSLIST_HEADER)&StackTraceBlock[7].StackWalkDpc.ProcessorHistory);
v4 = 4 * KeQueryActiveProcessorCountEx(0xFFFFu);
v5 = 16;
LODWORD(StackTraceBlock[7].StackWalkDpc.SystemArgument1) = v4;
if( v4 >= 0x10 )
v5 = v4;
else
LODWORD(StackTraceBlock[7].StackWalkDpc.SystemArgument1) = 16;
PoolWithTag = ExAllocatePoolWithTag(0x204ui64, 96i64 * v5, 1350005829i64);
StackTraceBlock[7].StackWalkDpc.DeferredContext = PoolWithTag;
if( !PoolWithTag )
goto LABEL_11;
for( i = 0i64; (unsigned int)i < LODWORD(StackTraceBlock[7].StackWalkDpc.SystemArgument1); i = (unsigned int)(i + 1) )
RtlpInterlockedPushEntrySList(
p_ProcessorHistory,
(PSLIST_ENTRY)StackTraceBlock[7].StackWalkDpc.DeferredContext + 6 * i);
KeInitializeDpc((PRKDPC)&StackTraceBlock[6].ApcEntry, EtwpStackWalkDpc, 0i64);
BYTE1(StackTraceBlock[6].ApcEntry) = 2;
v8 = ExAllocatePoolWithTag(0x200ui64, 0x400ui64, 1836545093i64);
v9 = (unsigned __int64)v8;
if( v8 )
{
memset(v8, 0i64, 0x400u);
StackTraceBlock[7].ApcListHead.Region = v9;
LODWORD(StackTraceBlock[7].ApcListHead.Alignment) = 0x2000;
_m_prefetchw(&StackTraceBlock[6].StackWalkDpc.SystemArgument2);
if( (_InterlockedOr((volatile signed __int32 *)&StackTraceBlock[6].StackWalkDpc.SystemArgument2, 0x2000u) & 0x2000) == 0 )
EtwpReferenceStackLookasideList();
_InterlockedOr((volatile signed __int32 *)&StackTraceBlock[6].StackWalkDpc.SystemArgument2, 0x80u);
}
else
{
LABEL_11:
DeferredContext = StackTraceBlock[7].StackWalkDpc.DeferredContext;
if( DeferredContext )
ExFreePoolWithTag(DeferredContext, 0);
}
}Referenced by:
EtwpUpdateStackTracing