PopFxStartDeviceAccounting
VOID __stdcall PopFxStartDeviceAccounting(){
_ETHREAD *CurrentThread;
UINT64 v1;
UINT64 *i;
unsigned __int64 v3;
unsigned int j;
__int64 v5;
unsigned __int64 v6;
unsigned __int64 v7;
if( *(&stru_140C23628 + 1058) )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
ExAcquirePushLockSharedEx((_EX_PUSH_LOCK *)&stru_140C23628 + 489, 0i64);
v1 = *(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart;
for( i = (UINT64 *)*(&stru_140C23628 + 485); i != (UINT64 *)((char *)&stru_140C23628 + 3880); i = (UINT64 *)*i )
{
if( i[6] )
{
if( *(&stru_140C23628 + 1058) < 0 )
{
v3 = (unsigned __int8)KeAcquireSpinLockRaiseToDpc(i + 75);
memset(i + 79, 0i64, 0xC0u);
if( *((_BYTE *)i + 608) )
i[78] = v1;
KxReleaseSpinLock(i + 75);
__writecr8(v3);
}
for( j = 0; j < *((_DWORD *)i + 207); ++j )
{
v5 = *(_QWORD *)(i[104] + 8i64 * j);
v6 = (unsigned __int8)KeAcquireSpinLockRaiseToDpc((UINT64 *)(v5 + 200));
memset((VOID *)(v5 + 232), 0i64, 0xC0u);
if( *(_BYTE *)(v5 + 208) )
*(_QWORD *)(v5 + 224) = v1;
KxReleaseSpinLock((UINT64 *)(v5 + 200));
__writecr8(v6);
}
}
}
v7 = (unsigned __int8)KeAcquireSpinLockRaiseToDpc((UINT64 *)&stru_140C23628 + 549);
*(&stru_140C23628 + 537) = 0i64;
*(&stru_140C23628 + 538) = 0i64;
memset((char *)&stru_140C23628 + 4312, 0i64, 0x50u);
KxReleaseSpinLock((UINT64 *)&stru_140C23628 + 549);
__writecr8(v7);
if( _InterlockedCompareExchange64((_QWORD *)&stru_140C23628 + 489, 0i64, 17i64) != 17 )
ExfReleasePushLockShared((_EX_PUSH_LOCK *)&stru_140C23628 + 489);
KeAbPostRelease((char *)&stru_140C23628 + 3912);
KeLeaveCriticalRegionThread(KeGetCurrentThread());
}
}Referenced by:
PopCaptureSleepStudyStatistics