PpmPerfRecordUtility
VOID __stdcall PpmPerfRecordUtility(_KPRCB *Prcb, UINT64 MakeupCount){
_ETHREAD *NextThread;
_ETHREAD *IdleThread;
_ETHREAD *CurrentThread;
__int64 v6;
unsigned __int64 v7;
__int64 v8;
__int64 v9;
unsigned __int64 v10;
unsigned __int64 v11;
int v12;
int v13;
int bf_0;
int v15;
unsigned int v16;
unsigned __int64 v17;
unsigned __int64 v18;
const _EVENT_DESCRIPTOR *v19;
REGHANDLE v20;
__int64 v21;
UINT64 Keyword;
unsigned __int8 v23;
unsigned int *v24;
int v25;
unsigned int v26;
char v27;
unsigned __int64 v28;
unsigned int v29;
__int64 v30;
char *v31;
int v32;
int v33;
unsigned int v34;
__int16 v35;
int v36;
int v37;
__int64 v38;
_ETHREAD *v39;
__int64 v40;
unsigned __int64 v41;
unsigned __int64 v42;
unsigned __int64 v43;
_EVENT_DATA_DESCRIPTOR UserData;
__int64 *v45;
__int64 v46;
__int64 *v47;
__int64 v48;
__int64 *v49;
__int64 v50;
int *v51;
__int64 v52;
__int64 *v53;
__int64 v54;
__int64 *v55;
__int64 v56;
int *v57;
__int64 v58;
__int16 *v59;
__int64 v60;
unsigned __int8 *v61;
__int64 v62;
__int64 *v63;
__int64 v64;
NextThread = Prcb->NextThread;
IdleThread = Prcb->IdleThread;
CurrentThread = Prcb->CurrentThread;
v39 = IdleThread;
if( NextThread )
{
v6 = *(_QWORD *)NextThread->Tcb.gap0;
v7 = (unsigned __int64)NextThread->Tcb.InitialStack - *(_QWORD *)NextThread->Tcb.gap0;
v8 = *(_QWORD *)&NextThread->Tcb.gap0[16];
v9 = *(_QWORD *)&NextThread->Tcb.gap0[8];
v10 = NextThread->Tcb.QuantumTarget - v9;
v11 = (unsigned __int64)NextThread->Tcb.StackLimit - v8;
v12 = *(&NextThread->Tcb.MiscFlags + 1) - LODWORD(NextThread->Tcb.SListFaultAddress);
if( *(&PopIrpWorkerControlEvent + 306) )
{
v28 = v10 / (unsigned int)(*(&PopIrpWorkerControlEvent + 306) + 1);
IdleThread = v39;
v10 = v28;
if( v7 < v28 )
v28 = (unsigned __int64)NextThread->Tcb.InitialStack - *(_QWORD *)NextThread->Tcb.gap0;
v7 = v28;
if( v11 >= v10 )
v11 = v10;
}
*(_QWORD *)&NextThread->Tcb.gap0[8] = v9 + v10;
*(_QWORD *)NextThread->Tcb.gap0 = v6 + v7;
*(_QWORD *)&NextThread->Tcb.gap0[16] = v11 + v8;
LODWORD(NextThread->Tcb.SListFaultAddress) = *(&NextThread->Tcb.MiscFlags + 1);
if( v7 > v10 )
v7 = v10;
if( v11 > v10 )
v11 = v10;
if( v10 <= 1 )
v10 = 1i64;
if( IdleThread )
{
LODWORD(Prcb->RspBase) = IdleThread->Tcb.gap0[0] * (unsigned __int8)IdleThread->Tcb.gap0[1];
}
else
{
v13 = WORD2(Prcb->PrcbLock);
if( CurrentThread )
{
bf_0 = CurrentThread->Tcb._bf_0;
v15 = *(&CurrentThread->Tcb.MiscFlags + 1);
}
else
{
bf_0 = 100;
v15 = 100;
}
LODWORD(v40) = bf_0;
v16 = 0;
LOBYTE(v35) = 100;
LODWORD(v39) = v15;
v43 = v11;
v42 = v7;
v37 = 0;
v17 = v7 * (unsigned int)(100 * v15) / v10;
LOWORD(v38) = v17;
v18 = v7 * (unsigned int)(v13 * v15) / v10;
v41 = v10 - v7;
LOWORD(v36) = v18;
if( BYTE4(Prcb->PriorityState) )
{
v19 = &PPM_ETW_RECORDED_UTILITY;
LOWORD(v37) = LOBYTE(Prcb[-1].StaticAffinity.KeFlushTbDeepIdleAffinity.Bitmap[0]);
BYTE2(v37) = BYTE1(Prcb[-1].StaticAffinity.KeFlushTbDeepIdleAffinity.Bitmap[0]);
v52 = 3i64;
}
else
{
v19 = (const _EVENT_DESCRIPTOR *)PPM_ETW_RECORDED_UTILITY_HV;
v37 = *(_DWORD *)&Prcb->CurrentThread->Tcb.gap0[20];
v52 = 4i64;
}
v51 = &v37;
if( PpmEtwRegistered )
{
v20 = PpmEtwHandle;
if( PpmEtwHandle )
{
if( (v21 = *(_QWORD *)(PpmEtwHandle + 32), Keyword = v19->Keyword, *(_DWORD *)(v21 + 96))
&& ((v23 = *(_BYTE *)(v21 + 100), v19->Level <= v23) || !v23)
&& ((*(_DWORD *)(v21 + 104) & 0x40) != 0 && !Keyword
|| (Keyword & *(_QWORD *)(v21 + 112)) != 0 && (*(_QWORD *)(v21 + 120) & Keyword) == *(_QWORD *)(v21 + 120))
|| *(_BYTE *)(PpmEtwHandle + 101)
&& EtwpLevelKeywordEnabled(
(_TRACE_ENABLE_INFO *)(*(_QWORD *)(PpmEtwHandle + 40) + 96i64),
v19->Level,
Keyword) )
{
*(_QWORD *)&UserData.Size = 8i64;
UserData.Ptr = (unsigned __int64)&PopIrpWorkerControlEvent + 1216;
v46 = 8i64;
v45 = (__int64 *)&v41;
v48 = 8i64;
v47 = (__int64 *)&v42;
v50 = 4i64;
v49 = &v40;
v54 = 4i64;
v53 = (__int64 *)&v39;
v55 = &v38;
v57 = &v36;
v59 = &v35;
v61 = &NextThread->Tcb.WaitBlockFill4[9];
v63 = (__int64 *)&v43;
v56 = 2i64;
v58 = 2i64;
v60 = 1i64;
v62 = 1i64;
v64 = 8i64;
EtwWriteEx(v20, v19, 0i64, 0, 0, 0, 0xBu, &UserData);
}
}
}
v24 = *(unsigned int **)&Prcb->NestingLevel;
if( v24 )
{
v29 = *v24;
v30 = v24[1];
v31 = (char *)v24 + 10 * v30;
v24[2] += (unsigned __int16)v17 - *((unsigned __int16 *)v31 + 16);
v32 = *((unsigned __int16 *)v31 + 17);
*((_WORD *)v31 + 16) = v17;
v24[3] += (unsigned __int16)v18 - v32;
v33 = *((unsigned __int16 *)v31 + 18);
*((_WORD *)v31 + 17) = v18;
v24[4] += (unsigned __int16)v15 - v33;
*((_WORD *)v31 + 18) = v15;
v24[5] -= (unsigned __int8)v31[38];
v24[5] += NextThread->Tcb.WaitBlockFill4[8];
v31[38] = NextThread->Tcb.WaitBlockFill4[8];
v24[6] -= (unsigned __int8)v31[39];
v24[6] += NextThread->Tcb.WaitBlockFill4[9];
v31[39] = NextThread->Tcb.WaitBlockFill4[9];
v24[7] -= (unsigned __int8)v31[40];
v24[7] += NextThread->Tcb.WaitBlockFill4[10];
v31[40] = NextThread->Tcb.WaitBlockFill4[10];
if( (_DWORD)v30 + 1 != v29 )
v16 = v30 + 1;
v34 = v24[2];
v24[1] = v16;
LODWORD(v17) = v34 / v29;
LODWORD(v18) = v24[3] / v29;
v15 = v24[4] / v29;
v25 = v24[6] / v29;
}
else
{
LOWORD(v36) = *(_WORD *)&NextThread->Tcb.WaitBlockFill10[8];
LOBYTE(v25) = BYTE1(v36);
}
if( (unsigned __int8)v25 >= 0x64u )
LOBYTE(v25) = 100;
v26 = (unsigned int)v17 * (unsigned __int8)v25 / 0x64;
if( *(&PopIrpWorkerControlEvent + 313) == 5 )
{
LODWORD(v17) = v17 - v26;
v27 = 1;
LODWORD(v18) = v18 - (unsigned int)v18 * (unsigned __int8)v25 / 0x64;
}
else
{
v27 = 0;
}
LODWORD(Prcb->RspBase) = v17;
HIDWORD(Prcb->RspBase) = v18;
LODWORD(Prcb->PrcbLock) = v26;
HIWORD(Prcb->PrcbLock) = v15;
*(_DWORD *)&NextThread->Tcb.WaitBlockFill11[16] = v12;
if( v27 )
PpmPerfResetHistory(Prcb);
}
}
}Referenced by:
PpmCheckRecordAllUtility