EtwpProfileInterrupt

VOID __stdcall EtwpProfileInterrupt(_KTRAP_FRAME *TrapFrame, VOID *Context){
  _ETHREAD *CurrentThread; 
  unsigned __int64 Rip; 
  int v4; 
  int UniqueThread; 
  _EPROCESS *Process; 
  char v7; 
  struct _KPRCB *CurrentPrcb; 
  unsigned __int8 NestingLevel; 
  char v10; 
  _KSCHEDULING_GROUP *volatile SchedulingGroup; 
  char *v12; 
  INT64 v13; 
  unsigned __int64 v14; 
  int v15; 
  __int16 v16; 
  char v17; 
  char v18; 
  PGET_UPDATED_BUS_RESOURCE v19; 
  int v20; 
  int v21; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  Rip = TrapFrame->_Rip;
  v4 = 34656770;
  UniqueThread = (int)CurrentThread->Cid.UniqueThread;
  if( Rip > 0x7FFFFFFEFFFFi64 )
    v4 = 34658818;
  Process = CurrentThread->Tcb.Process;
  v17 = 0;
  v15 = UniqueThread;
  v7 = 8 * CurrentThread->Tcb.Priority;
  v17 = v7;
  v14 = Rip;
  v16 = 1;
  CurrentPrcb = KeGetCurrentPrcb();
  NestingLevel = CurrentPrcb->NestingLevel;
  if( NestingLevel != 2 )
  {
    if( NestingLevel <= 1u )
      goto LABEL_9;
    goto LABEL_7;
  }
  if( (KeGetPcr()->Prcb._bf_0 & 0x10001) == 0 )
  {
LABEL_7:
    v10 = v7 | 2;
    goto LABEL_8;
  }
  v10 = v7 | 1;
LABEL_8:
  v4 &= ~0x4000u;
  v17 = v10;
LABEL_9:
  SchedulingGroup = CurrentThread->Tcb.SchedulingGroup;
  if( SchedulingGroup )
  {
    v12 = (char *)SchedulingGroup + CurrentPrcb->ScbOffset;
    do
    {
      if( *((_DWORD *)v12 + 29) > 0xFFu )
        LOBYTE(SchedulingGroup) = -1;
      else
        LOBYTE(SchedulingGroup) = v12[116];
      if( (_BYTE)SchedulingGroup )
        break;
      v12 = (char *)*((_QWORD *)v12 + 51);
    }
    while( v12 );
  }
  v21 = 0;
  v19 = (PGET_UPDATED_BUS_RESOURCE)&v14;
  v18 = (char)SchedulingGroup;
  LODWORD(v13) = v4;
  v20 = 16;
  EtwTraceSiloKernelEvent((INT64)Process->ServerSilo, &v19, 1ui64, 0x20000002ui64, 3886, v13);
}

Referenced by: