KiTrackSystemCallEntry

NTSTATUS __fastcall KiTrackSystemCallEntry(VOID *SysCallAddress, INT64 a2, INT64 a3, INT64 a4){
  int v6; 
  int v8; 
  INT64 v9; 
  int v10; 
  NTSTATUS v11; 
  INT64 v12; 

  v6 = a3;
  LOBYTE(v8) = KeIsTraceCallbackAllowed(KeGetCurrentThread()->PreviousMode);
  if( v8 )
  {
    v9 = *(_QWORD *)KiSystemServiceTraceCallbackTable;
    if( (*(_BYTE *)(KiSystemServiceTraceCallbackTable + 8) & 1) != 0 && v9 )
      v9 ^= KiSystemServiceTraceCallbackTable;
    v10 = *(_BYTE *)(KiSystemServiceTraceCallbackTable + 8) & 1;
    while( v9 )
    {
      v11 = KiSystemServiceTraceTableCompareFunction((UINT64)SysCallAddress, v9);
      if( v11 >= 0 )
      {
        if( v11 <= 0 )
          break;
        v12 = *(_QWORD *)(v9 + 8);
      }
      else
      {
        v12 = *(_QWORD *)v9;
      }
      if( v10 && v12 )
        v9 ^= v12;
      else
        v9 = v12;
    }
    if( v9 && *(_BYTE *)(v9 + 40) && KiDynamicTraceEnabled )
    {
      _InterlockedIncrement(&KiSystemServiceTraceCallbacksActive);
      if( *(_BYTE *)(v9 + 40) )
        ((void(__fastcall *)(_QWORD, _QWORD, _QWORD, INT64, int, INT64))qword_140CFBBA0)(
          *(_QWORD *)(v9 + 24),
          *(_QWORD *)(v9 + 48),
          *(unsigned int *)(v9 + 32),
          a2,
          v6,
          a4);
      _InterlockedDecrement(&KiSystemServiceTraceCallbacksActive);
    }
  }
  else
  {
    LODWORD(v9) = 0;
  }
  return v9;
}

Referenced by: