EtwpKernelTraceRundown

VOID __stdcall EtwpKernelTraceRundown(PERFINFO_GROUPMASK *GroupMasks, UINT64 LoggerId, UINT8 Start){
  char v3; 
  char v5; 
  unsigned int v6; 
  char v8; 
  char v9; 
  _WMI_LOGGER_CONTEXT *v10; 
  UINT8 v11; 
  INT16 v12; 
  INT64 v13; 
  INT64 v14; 
  UINT64 v15; 
  PERFINFO_GROUPMASK v16; 
  int v17; 
  PERFINFO_GROUPMASK v18; 
  PERFINFO_GROUPMASK v19; 
  PERFINFO_GROUPMASK v20; 
  UINT64 a5; 
  UINT64 v22; 
  __int64 LoggerHandle[7]; 
  unsigned int v24; 
  int v25; 

  v24 = Start;
  v5 = v3;
  LOBYTE(LoggerHandle[0]) = 0;
  v6 = Start;
  IoSetThreadHardErrorMode(0);
  v9 = v8;
  v10 = EtwpOpenLogger(v6, (_ETW_SILODRIVERSTATE *)LoggerId, 0, (_ETW_LOGGER_HANDLE *)LoggerHandle);
  v15 = (UINT64)v10;
  if( v10 )
  {
    if( GroupMasks )
    {
      if( (GroupMasks[1] & 0x20) != 0 && !v5 )
        EtwpLogRefSetAutoMark(0, (UINT64)v10, v13, v14, a5, v22, LoggerHandle[0]);
      v16 = *GroupMasks;
      if( (*GroupMasks & 0xC004) != 0
        || (GroupMasks[4] & 0x40) != 0
        || (v16 & 1) != 0
        || (v16 & 2) != 0
        || (GroupMasks[1] & 0x8000000) != 0 )
      {
        LODWORD(a5) = v25;
        EtwpProcessThreadImageRundown(GroupMasks, v15, v5);
        v16 = *GroupMasks;
      }
      v17 = v16 & 0x20000;
      if( v17 || (GroupMasks[2] & 0x1000000) != 0 )
        CmEtwRunDown((PFN_WDFREGISTRYQUERYULONG *)LoggerId, v6, v17 != 0, *((_BYTE *)GroupMasks + 11) & 1, v5);
      v18 = GroupMasks[1];
      if( (v18 & 2) != 0 )
      {
        EtwpSampledProfileRunDown(v15, v5, 1u);
        v18 = GroupMasks[1];
      }
      if( (v18 & 0x400) != 0 )
      {
        EtwpSampledProfileRunDown(v15, v5, 0);
        v18 = GroupMasks[1];
      }
      if( (v18 & 0x10000) != 0 )
      {
        EtwpSpinLockConfigRunDown(v15, v5);
        v18 = GroupMasks[1];
      }
      if( (v18 & 0x20000) != 0 )
      {
        EtwpExecutiveResourceConfigRunDown(v15, v5);
        v18 = GroupMasks[1];
      }
      if( (v18 & 0x400008) != 0 )
      {
        MmPerfLogSessionRundown(LoggerId, v6);
        v18 = GroupMasks[1];
      }
      if( (v18 & 0x8000049) != 0 )
        EtwpPoolRunDown(v15, v5);
      if( (GroupMasks[2] & 0x100000) != 0 )
        EtwpClockSourceRunDown(v15, v5);
      v19 = GroupMasks[1];
      if( v5 )
      {
        if( (v19 & 0x8000000) != 0 )
        {
          MmIdentifyPhysicalMemory(LoggerId, v6, 0x285ui64);
          MmLogSystemShareablePfnInfo(LoggerId, (VOID *)v6);
          v19 = GroupMasks[1];
        }
        if( (v19 & 0x20) != 0 )
          EtwpLogRefSetAutoMark(v5, v15, v13, v14, a5, v22, LoggerHandle[0]);
      }
      else
      {
        if( (v19 & 0x8000000) != 0 )
        {
          MmLogSystemShareablePfnInfo(LoggerId, (VOID *)v6);
          MmIdentifyPhysicalMemory(LoggerId, v6, 0x285ui64);
          v19 = GroupMasks[1];
        }
        if( (v19 & 9) != 0 )
        {
          EtwpLogMemInfoRundown(v15);
          MmIdentifyPhysicalMemory(LoggerId, v6, 0x223ui64);
          v19 = GroupMasks[1];
        }
        if( (v19 & 0x80000) != 0 )
        {
          MmLogQueryCombineStats((UINT64 *)LoggerId, (_PERFINFO_PAGECOMBINE_AGGREGATE_STAT *)&v24);
          v6 = v24;
        }
        if( (*GroupMasks & 0x200) != 0 )
          WmiTraceRundownNotify(**(_QWORD **)(v15 + 1080), v6);
        v20 = GroupMasks[4];
        if( (v20 & 0x8000) != 0 )
        {
          PopExecuteOnTargetProcessors(
            &KeActiveProcessors,
            (INT64 *)PpmTracePerfIdleRundown,
            0i64,
            0i64,
            a5,
            v22,
            LoggerHandle[0]);
          v20 = GroupMasks[4];
        }
        if( (v20 & 0x40) != 0 || (v20 & 0x80u) != 0 )
          EtwpObjectTypeRundown(v15, 0);
        if( (GroupMasks[2] & 0x10000) != 0 )
          EtwpProcessorRundown(v15, v11);
      }
    }
    EtwpCloseLogger(v6, (_ETW_SILODRIVERSTATE *)LoggerId, (_ETW_LOGGER_HANDLE)LoggerHandle[0]);
  }
  LOBYTE(v12) = v9;
  IoSetThreadHardErrorMode(v12);
}

Referenced by: