PerfDiagpProxyWorker

VOID __stdcall PerfDiagpProxyWorker(VOID *Parameter){
  int v1; 
  _ETHREAD *CurrentThread; 
  INT64 v3; 
  const wchar_t *v4; 
  NTSTATUS started; 
  char v6; 
  const wchar_t *v7; 
  UINT64 OutBufferLen; 
  UINT64 ReturnLength; 

  if( !Parameter )
    return;
  LODWORD(ReturnLength) = 0;
  v1 = *((_DWORD *)Parameter + 8);
  ExFreePoolWithTag(Parameter, 0);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)&ExBootDevicesRemovedEvent + 456, 0i64);
  if( !(unsigned int)PerfDiagpIsTracingAllowed() )
    goto LABEL_30;
  if( *(&ExBootDevicesRemovedEvent + 914) != v1 - 1 )
  {
    if( v1 == 3 )
    {
      if( *(&ExBootDevicesRemovedEvent + 914) == 1 )
        goto LABEL_11;
    }
    else if( ((v1 - 5) & 0xFFFFFFFD) == 0 )
    {
      goto LABEL_4;
    }
    if( v1 < *(&ExBootDevicesRemovedEvent + 914) )
    {
      v1 = *(&ExBootDevicesRemovedEvent + 914);
      goto LABEL_11;
    }
LABEL_30:
    *(&ExBootDevicesRemovedEvent + 914) = 8;
    goto LABEL_12;
  }
LABEL_4:
  if( v1 == 1 )
  {
    v7 = (const wchar_t *)L"Diagnostics\\Performance\\BootCKCLSettings";
  }
  else
  {
    v3 = (unsigned int)(v1 - 2);
    if( v1 == 2 )
    {
      v4 = (const wchar_t *)L"WaitingForLogonEnableKernelFlags";
      goto LABEL_9;
    }
    v3 = (unsigned int)(v1 - 3);
    switch( v1 )
    {
      case 3:
        v4 = L"EnableKernelFlags";
LABEL_9:
        LOBYTE(started) = PerfDiagpUpdatePerfDiagLoggerEnableFlags(v3, (INT64)v4);
        goto LABEL_10;
      case 4:
LABEL_16:
        PerfDiagpInitializeLoggerInfo(0i64, 0i64);
        LODWORD(OutBufferLen) = *(&ExBootDevicesRemovedEvent + 924);
        NtTraceControl(
          2ui64,
          (char *)&ExBootDevicesRemovedEvent + 3696,
          *(&ExBootDevicesRemovedEvent + 924),
          (char *)&ExBootDevicesRemovedEvent + 3696,
          OutBufferLen,
          &ReturnLength);
        goto LABEL_11;
      case 5:
        v7 = L"Diagnostics\\Performance\\SecondaryLogonCKCLSettings";
        break;
      case 6:
        goto LABEL_16;
      case 7:
        PerfDiagpSaveActiveDCLLogFileName();
        v7 = L"Diagnostics\\Performance\\ShutdownCKCLSettings";
        break;
      default:
        goto LABEL_11;
    }
  }
  started = PerfDiagpStartPerfDiagLogger((_NTSTRSAFE_PCWSTR)v7);
LABEL_10:
  if( started < 0 )
    goto LABEL_30;
LABEL_11:
  *(&ExBootDevicesRemovedEvent + 914) = v1;
LABEL_12:
  v6 = _InterlockedExchangeAdd64((_QWORD *)&ExBootDevicesRemovedEvent + 456, 0xFFFFFFFFFFFFFFFFui64);
  if( (v6 & 2) != 0 && (v6 & 4) == 0 )
    ExfTryToWakePushLock((_EX_PUSH_LOCK *)&ExBootDevicesRemovedEvent + 456);
  KeAbPostRelease((char *)&ExBootDevicesRemovedEvent + 3648);
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
}

Referenced by: