KiStopProfileTarget
VOID __stdcall KiStopProfileTarget(UINT64 Argument){
__int64 v1;
unsigned __int8 CurrentIrql;
__int64 v4;
__int64 v5;
_QWORD *v6;
_QWORD *v7;
_QWORD *v8;
int v9;
INT64 v10;
__int64 v12;
_QWORD *v13;
struct _KPRCB *CurrentPrcb;
int v15[8];
_KAFFINITY_ENUMERATION_CONTEXT Context;
UINT64 ProcIndex;
v1 = *(_QWORD *)Argument;
LODWORD(ProcIndex) = 0;
memset(&Context, 0, sizeof(Context));
CurrentIrql = KeGetCurrentIrql();
__writecr8((unsigned __int8)KiProfileIrql);
if( !_InterlockedDecrement((volatile signed __int32 *)(Argument + 8)) && *(_BYTE *)(v1 + 242) )
{
*(_BYTE *)(v1 + 242) = 0;
v4 = v1 + 8;
v5 = *(_QWORD *)(v1 + 8);
if( v5 != v1 + 8 )
{
v6 = *(_QWORD **)(v1 + 16);
if( *(_QWORD *)(v5 + 8) != v4 || *v6 != v4 )
goto LABEL_21;
*v6 = v5;
*(_QWORD *)(v5 + 8) = v6;
}
v7 = (_QWORD *)KiProfileSourceListHead;
do
{
v8 = v7;
v7 = (_QWORD *)*v7;
}
while( *((_DWORD *)v8 + 4) != *(__int16 *)(v1 + 240) );
Context.CurrentMask = *(_QWORD *)(v1 + 80);
Context.Affinity = (_KAFFINITY_EX *)(v1 + 72);
while( 1 )
{
KeEnumerateNextProcessor(&ProcIndex, &Context);
if( v9 )
break;
v10 = (unsigned int)ProcIndex;
if( (*((_DWORD *)v8 + (unsigned int)ProcIndex + 48))-- == 1 )
KeAddProcessorAffinityEx((UINT16 *)(Argument + 16), v10);
}
_InterlockedOr(v15, 0);
KeSubtractAffinityEx((WORD *)v8 + 12, (INT8 *)(Argument + 16), (INT8 *)v8 + 24);
if( !KeIsEmptyAffinityEx((WORD *)v8 + 12) )
goto LABEL_17;
v12 = *v8;
v13 = (_QWORD *)v8[1];
if( *(_QWORD **)(*v8 + 8i64) == v8 && (_QWORD *)*v13 == v8 )
{
*v13 = v12;
*(_QWORD *)(v12 + 8) = v13;
*(_QWORD *)(Argument + 184) = v8;
LABEL_17:
*(_BYTE *)(Argument + 192) = 1;
goto LABEL_18;
}
LABEL_21:
__fastfail(3u);
}
LABEL_18:
_InterlockedAdd((volatile signed __int32 *)(Argument + 12), 0xFFFFFFFF);
while( *(int *)(Argument + 12) > 0 )
_mm_pause();
CurrentPrcb = KeGetCurrentPrcb();
if( (*(_QWORD *)(Argument + 8i64 * CurrentPrcb->Group + 24) & CurrentPrcb->GroupSetMember) != 0 )
(*((void(__fastcall **)(_QWORD, _QWORD))HalpProfileInterface[0] + 2))((unsigned int)*(__int16 *)(v1 + 240), 0i64);
__writecr8(CurrentIrql);
}Referenced by:
KeStopProfile