EtwpCCSwapStart

NTSTATUS __stdcall EtwpCCSwapStart(UINT64 ClockType){
  unsigned int v1; 
  __int64 v2; 
  int v3; 
  unsigned int v4; 
  _BYTE *EtwSupport; 
  VOID **PoolWithTag; 
  unsigned int i; 
  PVOID *v9; 

  v1 = KeNumberProcessors_0;
  v2 = (unsigned int)ClockType;
  v3 = CCSwapNumLoggersPerClockType[(unsigned int)ClockType];
  if( v3 || (v4 = 0, !(_DWORD)KeNumberProcessors_0) )
  {
LABEL_7:
    CCSwapNumLoggersPerClockType[v2] = v3 + 1;
    return 0;
  }
  while( 1 )
  {
    EtwSupport = KeGetPrcb(v4)->EtwSupport;
    if( *(_QWORD *)&EtwSupport[8 * v2 + 296] )
    {
      EtwSupport[v2 + 288] = 0;
      goto LABEL_5;
    }
    PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x400ui64, 2004042563i64);
    *(_QWORD *)&EtwSupport[8 * v2 + 296] = PoolWithTag;
    if( !PoolWithTag )
      break;
LABEL_5:
    ++v4;
    **(_DWORD **)&EtwSupport[8 * v2 + 296] = 0;
    if( v4 >= v1 )
    {
      v3 = CCSwapNumLoggersPerClockType[v2];
      goto LABEL_7;
    }
  }
  for( i = 0; i < v4; ++i )
  {
    v9 = (PVOID *)KeGetPrcb(i)->EtwSupport;
    ExFreePoolWithTag(v9[v2 + 37], 0);
    v9[v2 + 37] = 0i64;
  }
  return -1073741801;
}

Referenced by: