EtwpInitializeStackTracing

VOID __stdcall EtwpInitializeStackTracing(_ETW_STACK_TRACE_BLOCK *StackTraceBlock, UINT64 ProcessorIndex){
  _SLIST_HEADER *p_ProcessorHistory; 
  unsigned int v4; 
  unsigned int v5; 
  VOID **PoolWithTag; 
  __int64 i; 
  VOID **v8; 
  unsigned __int64 v9; 
  void *DeferredContext; 

  p_ProcessorHistory = (_SLIST_HEADER *)&StackTraceBlock[7].StackWalkDpc.ProcessorHistory;
  InitializeSListHead((PSLIST_HEADER)&StackTraceBlock[7].StackWalkDpc.ProcessorHistory);
  v4 = 4 * KeQueryActiveProcessorCountEx(0xFFFFu);
  v5 = 16;
  LODWORD(StackTraceBlock[7].StackWalkDpc.SystemArgument1) = v4;
  if( v4 >= 0x10 )
    v5 = v4;
  else
    LODWORD(StackTraceBlock[7].StackWalkDpc.SystemArgument1) = 16;
  PoolWithTag = ExAllocatePoolWithTag(0x204ui64, 96i64 * v5, 1350005829i64);
  StackTraceBlock[7].StackWalkDpc.DeferredContext = PoolWithTag;
  if( !PoolWithTag )
    goto LABEL_11;
  for( i = 0i64; (unsigned int)i < LODWORD(StackTraceBlock[7].StackWalkDpc.SystemArgument1); i = (unsigned int)(i + 1) )
    RtlpInterlockedPushEntrySList(
      p_ProcessorHistory,
      (PSLIST_ENTRY)StackTraceBlock[7].StackWalkDpc.DeferredContext + 6 * i);
  KeInitializeDpc((PRKDPC)&StackTraceBlock[6].ApcEntry, EtwpStackWalkDpc, 0i64);
  BYTE1(StackTraceBlock[6].ApcEntry) = 2;
  v8 = ExAllocatePoolWithTag(0x200ui64, 0x400ui64, 1836545093i64);
  v9 = (unsigned __int64)v8;
  if( v8 )
  {
    memset(v8, 0i64, 0x400u);
    StackTraceBlock[7].ApcListHead.Region = v9;
    LODWORD(StackTraceBlock[7].ApcListHead.Alignment) = 0x2000;
    _m_prefetchw(&StackTraceBlock[6].StackWalkDpc.SystemArgument2);
    if( (_InterlockedOr((volatile signed __int32 *)&StackTraceBlock[6].StackWalkDpc.SystemArgument2, 0x2000u) & 0x2000) == 0 )
      EtwpReferenceStackLookasideList();
    _InterlockedOr((volatile signed __int32 *)&StackTraceBlock[6].StackWalkDpc.SystemArgument2, 0x80u);
  }
  else
  {
LABEL_11:
    DeferredContext = StackTraceBlock[7].StackWalkDpc.DeferredContext;
    if( DeferredContext )
      ExFreePoolWithTag(DeferredContext, 0);
  }
}

Referenced by:

EtwpUpdateStackTracing