KiTraceSetTimer

VOID __stdcall KiTraceSetTimer(_KTIMER *Timer, _KDPC *Dpc, UINT8 ThreadTimer){
  UINT64 v4; 
  __int64 v7; 
  UINT16 v8; 
  UINT64 Flag; 
  __int64 v10[2]; 
  __int16 v11; 
  char v12; 
  char v13; 
  int v14; 
  char v15; 
  char v16; 
  __int16 v17; 
  int v18; 
  EVENT_DATA_DESCRIPTOR EventData; 
  v18 = 0;
  v4 = *((unsigned __int16 *)Timer + 28);
  v13 = 0;
  v10[0] = *((_QWORD *)Timer + 3);
  v14 = *((_DWORD *)Timer + 15);
  v15 = *((_BYTE *)Timer + 1) >> 2;
  _InterlockedAnd((volatile signed __int32 *)Timer, 0xFFFFFF7F);
  KeGetPrcb(v4);
  v10[1] = (__int64)Timer;
  v11 = *(unsigned __int8 *)(v7 + 208);
  v12 = *(_BYTE *)(v7 + 209);
  v13 = 0;
  v16 = 0;
  v17 = *(_WORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1088i64);
  v13 = v15 != 0;
  if( Dpc )
    v13 = (v15 != 0) | 2;
  if( *((_DWORD *)Timer + 15) )
  {
    v8 = 3922;
  }
  else
  {
    v8 = 3924;
    if( !ThreadTimer )
      v8 = 3923;
  }
  EventData.Reserved = 0;
  EventData.Ptr = (unsigned __int64)v10;
  EventData.Size = 32;
  LODWORD(Flag) = ThreadTimer != 0 ? 1538 : 6298370;
  EtwTraceKernelEvent(&EventData, 1ui64, 0x40020000ui64, v8, Flag);
}

Referenced by: