EtwpCovSampContextPruneModules
UINT64 __stdcall EtwpCovSampContextPruneModules(INT64 a1){
UINT64 result;
__int64 v3;
_QWORD *v4;
__int64 v5;
_ETHREAD *CurrentThread;
volatile signed __int64 *v7;
__int64 *i;
unsigned int v9;
__int64 v10;
_QWORD *v11;
_OWORD *v12;
_QWORD *v13;
__int128 *v14;
_QWORD *v15;
__int64 v16;
_ETHREAD *v17;
__int128 *v18;
__int128 *v19;
char *v20;
bool v21;
int v22;
char *j;
_QWORD *v24;
int v25;
_QWORD *k;
_QWORD *v27;
__int64 v28;
_QWORD *v29;
_OWORD **v30;
__int64 v31;
void *v32;
__int64 v33;
__int128 v34;
__int128 v35;
_OWORD v36[8];
result = *(_DWORD *)(a1 + 16) >> 1;
v35 = 0i64;
v34 = 0i64;
if( *(_DWORD *)(a1 + 732) > (unsigned int)result || *(_DWORD *)(a1 + 1124) > (int)result )
{
result = (unsigned int)_InterlockedCompareExchange(
(volatile signed __int32 *)(a1 + 1128),
(signed __int32)PsGetCurrentThreadId(),
0);
if( !(_DWORD)result )
{
v3 = 8i64;
v4 = v36;
v5 = 8i64;
do
{
v4[1] = v4;
*v4 = v4;
v4 += 2;
--v5;
}
while( v5 );
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
v7 = (volatile signed __int64 *)(a1 + 664);
ExAcquirePushLockSharedEx((_EX_PUSH_LOCK *)(a1 + 664), 0i64);
for( i = *(__int64 **)(a1 + 712); i != (__int64 *)(a1 + 712); i = (__int64 *)*i )
{
if( *(i - 1) == 1 && !*((_DWORD *)i + 15) )
{
v9 = KUSER_SHARED_DATA.TickCount.LowPart - *((_DWORD *)i + 16);
if( v9 >= 0x100 )
v10 = ((v9 - 256) >> 8) + 4;
else
v10 = v9 >> 6;
if( (unsigned int)v10 >= 8 )
v10 = 7i64;
v11 = i + 2;
v12 = &v36[v10];
v13 = (_QWORD *)*((_QWORD *)v12 + 1);
if( (_OWORD *)*v13 != v12 )
LABEL_54:
__fastfail(3u);
*v11 = v12;
i[3] = (__int64)v13;
*v13 = v11;
*((_QWORD *)v12 + 1) = v11;
}
}
if( _InterlockedCompareExchange64(v7, 0i64, 17i64) != 17 )
ExfReleasePushLockShared((_EX_PUSH_LOCK *)(a1 + 664));
KeAbPostRelease((VOID *)(a1 + 664));
KeLeaveCriticalRegionThread(KeGetCurrentThread());
v14 = &v35;
*((_QWORD *)&v35 + 1) = &v35;
*(_QWORD *)&v35 = &v35;
v15 = v36;
do
{
if( (_QWORD *)*v15 != v15 )
{
*(_QWORD *)v14 = *v15;
*(_QWORD *)(*v15 + 8i64) = *((_QWORD *)&v35 + 1);
*((_QWORD *)&v35 + 1) = v15[1];
**((_QWORD **)&v35 + 1) = &v35;
v14 = (__int128 *)*((_QWORD *)&v35 + 1);
}
v15 += 2;
--v3;
}
while( v3 );
v16 = 0i64;
*((_QWORD *)&v34 + 1) = &v34;
*(_QWORD *)&v34 = &v34;
v17 = (_ETHREAD *)KeGetCurrentThread();
--v17->Tcb.KernelApcDisable;
ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)(a1 + 664), 0i64);
v18 = (__int128 *)v35;
*(_QWORD *)(a1 + 672) = KeGetCurrentThread();
while( v18 != &v35 )
{
v19 = v18;
v20 = (char *)v18 - 88;
v21 = *((_QWORD *)v18 - 3) == 1i64;
v18 = *(__int128 **)v18;
*((_QWORD *)v19 + 1) = v19;
*(_QWORD *)v19 = v19;
if( v21 && !*((_DWORD *)v20 + 33) && ++v16 > (unsigned __int64)*(unsigned int *)(a1 + 16) )
{
if( (*((_DWORD *)v20 + 30) & 0x40000) == 0 )
{
v22 = *(_DWORD *)(a1 + 684) >> 5;
v33 = *((_QWORD *)v20 + 1) & (-1i64 << (*(_DWORD *)(a1 + 684) & 0x1F));
for( j = (char *)(*(_QWORD *)(a1 + 688)
+ 8i64
* ((37
* (BYTE6(v33)
+ 37
* (BYTE5(v33)
+ 37
* (BYTE4(v33)
+ 37
* (BYTE3(v33)
+ 37 * (BYTE2(v33) + 37 * (BYTE1(v33) + 37 * ((unsigned __int8)v33 + 11623883)))))))
+ HIBYTE(v33)) & (unsigned int)(v22 - 1))); (*(_QWORD *)j & 1) == 0; j = *(char **)j )
{
if( *(char **)j == v20 )
{
*(_QWORD *)j = *(_QWORD *)v20;
--*(_DWORD *)(a1 + 680);
break;
}
}
*(_QWORD *)v20 = 0i64;
}
v24 = v20 + 16;
if( *((_QWORD *)v20 + 2) )
{
v25 = *(_DWORD *)(a1 + 700) >> 5;
v33 = *((_QWORD *)v20 + 3) & (-1i64 << (*(_DWORD *)(a1 + 700) & 0x1F));
for( k = (_QWORD *)(*(_QWORD *)(a1 + 704)
+ 8i64
* ((37
* (BYTE6(v33)
+ 37
* (BYTE5(v33)
+ 37
* (BYTE4(v33)
+ 37
* (BYTE3(v33)
+ 37 * (BYTE2(v33) + 37 * (BYTE1(v33) + 37 * ((unsigned __int8)v33 + 11623883)))))))
+ HIBYTE(v33)) & (unsigned int)(v25 - 1))); (*k & 1) == 0; k = (_QWORD *)*k )
{
if( (_QWORD *)*k == v24 )
{
*k = *v24;
--*(_DWORD *)(a1 + 696);
break;
}
}
*v24 = 0i64;
}
v27 = v20 + 72;
v28 = *((_QWORD *)v20 + 9);
if( *(char **)(v28 + 8) != v20 + 72 )
goto LABEL_54;
v29 = (_QWORD *)*((_QWORD *)v20 + 10);
if( (_QWORD *)*v29 != v27 )
goto LABEL_54;
*v29 = v28;
*(_QWORD *)(v28 + 8) = v29;
v30 = (_OWORD **)*((_QWORD *)&v34 + 1);
--*(_DWORD *)(a1 + 728);
if( *v30 != &v34 )
goto LABEL_54;
*((_QWORD *)v20 + 10) = v30;
*v27 = &v34;
*v30 = v27;
*((_QWORD *)&v34 + 1) = v20 + 72;
}
}
*(_DWORD *)(a1 + 732) = 0;
*(_DWORD *)(a1 + 1124) = 0;
*(_QWORD *)(a1 + 672) = 0i64;
if( (_InterlockedExchangeAdd64(v7, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)(a1 + 664));
KeAbPostRelease((VOID *)(a1 + 664));
KeLeaveCriticalRegionThread(KeGetCurrentThread());
while( 1 )
{
result = v34;
if( (__int128 *)v34 == &v34 )
break;
if( *(__int128 **)(v34 + 8) != &v34 )
goto LABEL_54;
v31 = *(_QWORD *)v34;
if( *(_QWORD *)(*(_QWORD *)v34 + 8i64) != (_QWORD)v34 )
goto LABEL_54;
*(_QWORD *)&v34 = *(_QWORD *)v34;
v32 = (void *)(result - 72);
*(_QWORD *)(v31 + 8) = &v34;
*(_QWORD *)(result - 72 + 64) = 0i64;
*(_QWORD *)(result + 8) = result;
*(_QWORD *)result = result;
EtwpCovSampModuleCleanup(result - 72);
ExFreePoolWithTag(v32, 0x56777445u);
}
_InterlockedExchange((volatile __int32 *)(a1 + 1128), 0);
}
}
return result;
}Referenced by:
EtwpCovSampContextGetModule
EtwpCoverageSamplerQuery