KeInitializeProfile
VOID __stdcall KeInitializeProfile(
_KPROFILE *Profile,
_EPROCESS *Process,
UINT64 *Buffer,
VOID *RangeBase,
UINT64 RangeSize,
UINT64 BucketSize,
UINT64 Segment,
_KPROFILE_SOURCE ProfileSource,
_KAFFINITY_EX *ProfileAffinity){
INT8 *v9;
NTSTATUS v10;
v9 = (INT8 *)(Profile + 18);
*Profile = 16252951;
*((_QWORD *)Profile + 3) = Process;
Profile[12] = BucketSize - 2;
Profile[16] = Segment;
*((_WORD *)Profile + 120) = ProfileSource;
*((_QWORD *)Profile + 7) = Buffer;
*((_QWORD *)Profile + 4) = RangeBase;
*((_QWORD *)Profile + 5) = (char *)RangeBase + RangeSize;
*((_BYTE *)Profile + 242) = 0;
if( ProfileAffinity )
v10 = KeAndAffinityEx(&ProfileAffinity->Count, &KeActiveProcessors.Count, v9);
else
v10 = 0;
if( !v10 )
KeCopyAffinityEx((_KAFFINITY_EX *)v9, &KeActiveProcessors);
}Referenced by:
NtStartProfile