PerfLogExecutiveResourceSetOwnerPointer
VOID __stdcall PerfLogExecutiveResourceSetOwnerPointer(UINT64 Action, PVOID LockAddress){
struct _KPRCB *CurrentPrcb;
int v3;
INT64 TrackingLockSlotForThread;
UINT64 Flag;
__int64 v7[3];
int v8;
int v9;
PVOID v10;
int v11;
int v12;
EVENT_DATA_DESCRIPTOR EventData;
CurrentPrcb = KeGetCurrentPrcb();
v3 = Action;
LODWORD(Flag) = 22026242;
++*((_DWORD *)CurrentPrcb + 8540);
v11 = Action;
v10 = LockAddress;
memset(v7, 0, sizeof(v7));
v8 = 0;
v12 = 0;
*(_QWORD *)&EventData.Size = 48i64;
v9 = *((_DWORD *)KeGetCurrentThread() + 288);
EventData.Ptr = (unsigned __int64)v7;
EtwTraceKernelEvent(&EventData, 1ui64, 0x20020000ui64, 0x52Bu, Flag);
if( *((_QWORD *)KeGetCurrentThread() + 178) )
{
TrackingLockSlotForThread = EtwpGetTrackingLockSlotForThread((INT64)LockAddress, v3 & 0xFFFF0000);
if( TrackingLockSlotForThread )
{
if( *(_DWORD *)(TrackingLockSlotForThread + 32) )
{
++*((_DWORD *)CurrentPrcb + 8541);
*(_QWORD *)(TrackingLockSlotForThread + 16) = 0i64;
*(_QWORD *)(TrackingLockSlotForThread + 28) = 0i64;
*(_DWORD *)(TrackingLockSlotForThread + 36) = 0;
*(_QWORD *)TrackingLockSlotForThread = 0i64;
*(_QWORD *)(TrackingLockSlotForThread + 8) = 0i64;
*(_DWORD *)(TrackingLockSlotForThread + 24) = 0;
*(_DWORD *)(TrackingLockSlotForThread + 44) = 0;
}
else
{
*(_DWORD *)(TrackingLockSlotForThread + 28) = 0;
}
}
}
}Referenced by:
No references.