PfGetCompletedTrace

NTSTATUS __stdcall PfGetCompletedTrace(VOID *Buffer, UINT64 BufferSize, INT8 PreviousMode, UINT64 *ReturnSize){
  char **v4; 
  unsigned int v5; 
  int v6; 
  _BOOL4 v7; 
  int v8; 
  char *v9; 
  char *v10; 
  char **v11; 
  char *v12; 
  NTSTATUS v13; 
  unsigned int Length; 

  Length = BufferSize;
  v4 = 0i64;
  v5 = 0;
  v6 = 1;
  while( 1 )
  {
    ExAcquireFastMutex((PFAST_MUTEX)((char *)&stru_140C4DB30 + 0x2000));
    if( !*(&stru_140C4DB30 + 2046) )
      break;
    *(&stru_140C4DB30 + 2046) = 0;
    KeReleaseGuardedMutex((PKGUARDED_MUTEX)((char *)&stru_140C4DB30 + 0x2000));
    PfFbBufferListFlushStandby((_SLIST_ENTRY *)&stru_140C4DB30 + 491);
  }
  v7 = *(&stru_140C4DB30 + 2042) < *(&stru_140C4DB30 + 2043);
  v8 = 0;
  while( 1 )
  {
    v9 = (char *)&stru_140C4DB30 + 8176;
    if( v8 )
      v9 = (char *)&stru_140C4DB30 + 8168;
    v10 = (char *)&stru_140C4DB30 + 8152;
    if( v8 )
      v10 = (char *)&stru_140C4DB30 + 8136;
    v11 = *(char ***)v10;
    if( *(char **)v10 != v10 )
      break;
    if( (unsigned int)++v8 >= 2 )
      goto LABEL_15;
  }
  v4 = *(char ***)v10;
  v5 = *((_DWORD *)v11 + 6) + 16;
  if( v5 > Length )
  {
    *(_DWORD *)ReturnSize = v5;
    v13 = -1073741789;
    goto LABEL_20;
  }
  v12 = *v11;
  if( v11[1] != v10 || *((char ***)v12 + 1) != v11 )
    __fastfail(3u);
  *(_QWORD *)v10 = v12;
  *((_QWORD *)v12 + 1) = v10;
  --*(_DWORD *)v9;
LABEL_15:
  if( !v7 && *(&stru_140C4DB30 + 2042) < *(&stru_140C4DB30 + 2043) )
  {
    PfTAccessTracingStart((_PFP_TRACING_GLOBALS *)&stru_140C4DB30 + 1908, &PfKernelGlobals, PfpTraceStopTraceListFull);
    KeSetEvent((PRKEVENT)PfKernelGlobals.gap10, 0, 0);
  }
  KeReleaseGuardedMutex((PKGUARDED_MUTEX)((char *)&stru_140C4DB30 + 0x2000));
  v6 = 0;
  if( v4 )
  {
    if( PreviousMode )
      ProbeForWrite((UINT64)Buffer, Length, 8i64);
    *(_OWORD *)Buffer = 0i64;
    *(_DWORD *)Buffer = 1048577;
    *((_QWORD *)Buffer + 1) = ((KUSER_SHARED_DATA.TickCountMultiplier * HIDWORD(qword_140C50128)) << 8)
                            + ((KUSER_SHARED_DATA.TickCountMultiplier * (unsigned __int64)(unsigned int)qword_140C50128) >> 24);
    memmove((char *)Buffer + 16, v4 + 2, *((_DWORD *)v4 + 6));
    *(_DWORD *)ReturnSize = v5;
    PfTFreeTraceDump(v4);
    v13 = 0;
  }
  else
  {
    v13 = -2147483622;
  }
LABEL_20:
  if( v6 )
    KeReleaseGuardedMutex((PKGUARDED_MUTEX)((char *)&stru_140C4DB30 + 0x2000));
  return v13;
}

Referenced by: