IopProcessIoTracking

VOID __stdcall IopProcessIoTracking(UINT64 ElapsedTime, UINT64 DeviceType){
  char v2; 
  _ETHREAD *CurrentThread; 
  _ETHREAD *v4; 
  __int64 v5; 
  unsigned __int8 AbEntrySummary; 
  __int64 AbOrphanedEntrySummary; 
  __int64 v8; 
  NTSTATUS SessionId; 
  bool v10; 
  __int64 **i; 
  UINT64 a3; 
  _QWORD v13[3]; 

  v13[0] = 24i64;
  v2 = 0;
  v13[1] = ElapsedTime;
  v13[2] = (unsigned int)DeviceType;
  if( KeGetCurrentIrql() < 2u )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.SpecialApcDisable;
    v2 = 1;
  }
  LODWORD(a3) = 0;
  v4 = (_ETHREAD *)KeGetCurrentThread();
  --v4->Tcb.SpecialApcDisable;
  if( ++v4->Tcb.AbAllocationRegionCount != 1 )
  {
    v5 = 0i64;
    goto LABEL_5;
  }
  AbEntrySummary = v4->Tcb.AbEntrySummary;
  if( !AbEntrySummary )
  {
    if( !v4->Tcb.AbOrphanedEntrySummary )
    {
      v5 = 0i64;
      goto LABEL_5;
    }
    AbOrphanedEntrySummary = v4->Tcb.AbOrphanedEntrySummary;
    v4->Tcb.AbOrphanedEntrySummary = 0;
    AbEntrySummary = AbOrphanedEntrySummary | v4->Tcb.AbEntrySummary;
  }
  _BitScanForward((unsigned int *)&v8, AbEntrySummary);
  v4->Tcb.AbEntrySummary = AbEntrySummary & ~(1 << v8);
  v5 = (__int64)&v4->Tcb.LockEntries[v8];
  if( !v5 )
  {
LABEL_5:
    _interlockedbittestandset((volatile signed __int32 *)&v4->Tcb.116 + 1, 0x10u);
    goto LABEL_16;
  }
  if( (unsigned __int64)&stru_140C452E0 + 1648 >= 0xFFFF800000000000ui64
    && *((_BYTE *)&stru_140C4DB30 + ((((unsigned __int64)&stru_140C452E0 + 1648) >> 39) & 0x1FF) + 6872) == 1 )
  {
    SessionId = MmGetSessionIdEx(v4->Tcb.ApcState.Process);
  }
  else
  {
    SessionId = -1;
  }
  *(_DWORD *)(v5 + 40) = SessionId;
  *(_QWORD *)(v5 + 32) = ((unsigned __int64)&stru_140C452E0 + 1648) & 0x7FFFFFFFFFFFFFFCi64;
LABEL_16:
  --v4->Tcb.AbAllocationRegionCount;
  KiAbThreadRemoveBoosts(&v4->Tcb, (char *)&stru_140C452E0 + 1648, &a3);
  v10 = v4->Tcb.SpecialApcDisable++ == -1;
  if( v10 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v4->Tcb.ApcState.ApcListHead[0].Flink != &v4->Tcb.152 )
    KiCheckForKernelApcDelivery();
  if( !_InterlockedCompareExchange64((_QWORD *)&stru_140C452E0 + 206, 17i64, 0i64)
    || ExfTryAcquirePushLockShared((_EX_PUSH_LOCK *)&stru_140C452E0 + 206) )
  {
    if( v5 )
      *(_BYTE *)(v5 + 26) |= 1u;
    for( i = (__int64 **)*(&stru_140C452E0 + 210); i != (__int64 **)((char *)&stru_140C452E0 + 1680); i = (__int64 **)*i )
      ((void(__fastcall *)(_QWORD *))i[2])(v13);
    if( _InterlockedCompareExchange64((_QWORD *)&stru_140C452E0 + 206, 0i64, 17i64) != 17 )
      ExfReleasePushLockShared((_EX_PUSH_LOCK *)&stru_140C452E0 + 206);
    KeAbPostRelease((char *)&stru_140C452E0 + 1648);
  }
  else if( v5 )
  {
    KeAbPostReleaseEx((char *)&stru_140C452E0 + 1648, (VOID *)v5);
  }
  if( v2 == 1 )
    KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
}

Referenced by: