EtwpCoverageSamplerReadyThread
CHAR __fastcall EtwpCoverageSamplerReadyThread(INT64 a1){
_ETHREAD *CurrentThread;
struct _KPRCB *CurrentPrcb;
__int64 v3;
unsigned int v4;
unsigned int v5;
__int64 v6;
unsigned int LowPart;
int v8;
int v9;
int v10;
unsigned int v11;
unsigned int v12;
unsigned int v13;
int v14;
int v15;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
if( *(_ETHREAD **)StartContext != CurrentThread && *(_QWORD *)StartContext != a1 )
{
CurrentPrcb = KeGetCurrentPrcb();
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
if( CurrentThread != *((_ETHREAD **)CurrentPrcb + 3) || *((_BYTE *)CurrentPrcb + 32) > 1u )
{
v3 = (*(_QWORD *)(StartContext + 8) >> 4) & 0x1FFi64;
v4 = ((unsigned int)*(_QWORD *)(StartContext + 8) >> 13) & 0x3FFFF;
_BitScanReverse(&v5, v4);
v6 = *(_QWORD *)(*(_QWORD *)(*((_QWORD *)KeGetCurrentPrcb() + 4198) + 8i64 * (v5 - 2))
+ 8i64 * (v4 ^ (1 << v5))
+ 8);
if( !*(_DWORD *)(v6 + 8 * v3 + 224) )
{
LABEL_15:
_InterlockedIncrement((volatile signed __int32 *)(v6 + 8 * v3 + 328));
LOBYTE(CurrentThread) = EtwpCovSampCaptureSample(0i64, 0x30000008ui64);
return(char)CurrentThread;
}
LowPart = KUSER_SHARED_DATA.TickCount.LowPart;
LODWORD(CurrentThread) = KUSER_SHARED_DATA.TickCount.LowPart - *(_DWORD *)(v6 + 8 * v3 + 228);
if( (unsigned int)CurrentThread > *(_DWORD *)(v6 + 8 * v3 + 232) )
{
v8 = *(_DWORD *)(v6 + 8 * v3 + 224);
*(_DWORD *)(v6 + 8 * v3 + 244) += v8;
v9 = *(_DWORD *)(v6 + 8 * v3 + 244);
v10 = *(_DWORD *)(v6 + 8 * v3 + 240);
LODWORD(CurrentThread) = 2 * v8;
if( v9 > *(_DWORD *)(v6 + 8 * v3 + 236) )
v9 = *(_DWORD *)(v6 + 8 * v3 + 236);
*(_DWORD *)(v6 + 8 * v3 + 228) = LowPart;
v11 = *(_DWORD *)(v6 + 8 * v3 + 252) + v10;
*(_DWORD *)(v6 + 8 * v3 + 240) = 0;
v12 = v11 >> 1;
*(_DWORD *)(v6 + 8 * v3 + 244) = v9;
*(_DWORD *)(v6 + 8 * v3 + 252) = v12;
if( v12 >= (unsigned int)CurrentThread )
{
v13 = v12 / (v8 + 1);
v14 = 16777619 * (*(_DWORD *)(v6 + 8 * v3 + 260) ^ LowPart);
*(_DWORD *)(v6 + 8 * v3 + 256) = v13;
LODWORD(CurrentThread) = v14 & (2 * v13);
*(_DWORD *)(v6 + 8 * v3 + 260) = v14;
*(_DWORD *)(v6 + 8 * v3 + 248) = (_DWORD)CurrentThread;
}
else
{
*(_DWORD *)(v6 + 8 * v3 + 256) = 1;
*(_DWORD *)(v6 + 8 * v3 + 248) = 1;
}
}
++*(_DWORD *)(v6 + 8 * v3 + 240);
v15 = *(_DWORD *)(v6 + 8 * v3 + 244);
if( v15 > 0 )
{
LODWORD(CurrentThread) = --*(_DWORD *)(v6 + 8 * v3 + 248);
if( (int)CurrentThread <= 0 )
{
*(_DWORD *)(v6 + 8 * v3 + 244) = v15 - 1;
*(_DWORD *)(v6 + 8 * v3 + 248) = *(_DWORD *)(v6 + 8 * v3 + 256);
goto LABEL_15;
}
}
}
}
return(char)CurrentThread;
}Referenced by:
EtwTraceReadyThread