EtwpCCSwapTrace

VOID __stdcall EtwpCCSwapTrace(_ETHREAD *OldEThread, _ETHREAD *NewEThread, UINT64 ClockType, _LARGE_INTEGER *TimeStamp){
  unsigned int v4; 
  int v5; 
  __int64 v8; 
  _QWORD *EtwSupport; 
  _LARGE_INTEGER *v10; 
  LONGLONG QuadPart; 
  _LARGE_INTEGER *v12; 
  __int64 v13; 
  unsigned int UniqueThread; 
  unsigned int v15; 
  char Priority; 
  unsigned int v17; 
  int v18; 
  volatile unsigned __int8 v19; 
  int v20; 
  size_t v21; 
  volatile unsigned __int8 State; 
  unsigned int v23; 
  LONGLONG v24; 
  unsigned int v25; 
  unsigned int LowPart; 
  __int64 Src; 
  int v28; 

  v28 = ClockType;
  v4 = 0;
  v5 = ClockType;
  Src = 0i64;
  v8 = (unsigned int)ClockType;
  EtwSupport = KeGetCurrentPrcb()->EtwSupport;
  v10 = (_LARGE_INTEGER *)EtwSupport[(unsigned int)ClockType + 37];
  if( v10 )
  {
    QuadPart = TimeStamp->QuadPart;
    v12 = v10 + 3;
    if( v10->anonymous_0.LowPart )
    {
      v13 = QuadPart - v10[1].QuadPart;
    }
    else
    {
      LowPart = KUSER_SHARED_DATA.TickCount.LowPart;
      v10[1].QuadPart = QuadPart;
      v10[2].QuadPart = QuadPart;
      v10->anonymous_0.HighPart = LowPart;
      v10->anonymous_0.LowPart = 104;
      memset(&v10[3], 0i64, 0x40u);
      v5 = v28;
      v13 = 0i64;
    }
    UniqueThread = (unsigned int)OldEThread->Cid.UniqueThread;
    v15 = 0;
    if( UniqueThread )
    {
      while( v12->anonymous_0.LowPart != UniqueThread )
      {
        if( !v12->anonymous_0.LowPart )
        {
          *(&v10[3].anonymous_0.LowPart + v15) = UniqueThread;
          *((_BYTE *)&v10[11].anonymous_0.LowPart + v15) = OldEThread->Tcb.BasePriority;
          break;
        }
        ++v15;
        v12 = (_LARGE_INTEGER *)((char *)v12 + 4);
        if( v15 >= 0x10 )
          break;
      }
    }
    if( v15 == 16
      || KUSER_SHARED_DATA.TickCount.LowPart - v10->anonymous_0.HighPart > 0x1F4
      || (unsigned __int64)v10->anonymous_0.LowPart + 8 > 0x400
      || v13 > 0x40000000
      || *((_BYTE *)EtwSupport + v8 + 288) )
    {
      EtwpCCSwapFlush(v10, v5);
      v24 = TimeStamp->QuadPart;
      v25 = KUSER_SHARED_DATA.TickCount.LowPart;
      v10[1] = *TimeStamp;
      v10[2].QuadPart = v24;
      v10->anonymous_0.HighPart = v25;
      v10->anonymous_0.LowPart = 104;
      memset(&v10[3], 0i64, 0x40u);
      *((_BYTE *)EtwSupport + v8 + 288) = 0;
      v13 = 0i64;
      v10[3].anonymous_0.LowPart = UniqueThread;
      v15 = 0;
    }
    if( UniqueThread )
    {
      if( LODWORD(NewEThread->Cid.UniqueThread) )
        v4 = KUSER_SHARED_DATA.TickCount.LowPart - NewEThread->Tcb.WaitBlock[2].SpareLong;
      Priority = OldEThread->Tcb.Priority;
      v17 = Priority - *((char *)&v10[11].QuadPart + v15);
      if( v4 > 1 || v17 > 7 || v13 >= 0x20000 )
      {
        LODWORD(Src) = (4 * v13) | 3;
        if( v4 >= 0x1FFFF )
          v4 = 0x1FFFF;
        State = OldEThread->Tcb.State;
        HIDWORD(Src) = (WORD2(Src) ^ ((unsigned __int8)v15 ^ BYTE4(Src)) & 0xF) & 0x3FF | (((32 * v4) | Priority & 0x1F) << 10);
        if( State == 5 )
          v23 = (WORD2(Src) ^ (unsigned __int16)(16 * OldEThread->Tcb.WaitReason)) & 0x3F0 ^ HIDWORD(Src);
        else
          v23 = (16 * OldEThread->Tcb.WaitBlockFill6[68] - 369) & 0x3F0 | HIDWORD(Src) & 0xFFFFFC0F;
        HIDWORD(Src) = v23;
        v21 = 8;
      }
      else
      {
        v18 = v17 & 7 | ((_DWORD)v13 << 9);
        v19 = OldEThread->Tcb.State;
        LODWORD(Src) = (4 * (v15 & 0xF | (16 * v18))) | 2;
        if( v19 == 5 )
          v20 = ((unsigned __int16)Src ^ (unsigned __int16)(OldEThread->Tcb.WaitReason << 9)) & 0x7E00 ^ Src;
        else
          v20 = ((OldEThread->Tcb.WaitBlockFill6[68] << 9) - 11777) & 0x7E00 | Src & 0xFFFF81FF;
        LODWORD(Src) = v20;
        v21 = 4;
      }
    }
    else if( v13 >= 0x4000 )
    {
      v21 = 4;
      LODWORD(Src) = (4 * v13) | 1;
    }
    else
    {
      v21 = 2;
      LOWORD(Src) = 4 * v13;
    }
    memmove((char *)v10 + v10->anonymous_0.LowPart, &Src, v21);
    v10->anonymous_0.LowPart += v21;
    v10[1] = *TimeStamp;
  }
}

Referenced by: