EtwpKernelTraceRundown

VOID __fastcall EtwpKernelTraceRundown(_PERFINFO_GROUPMASK *GroupMasks, UINT64 LoggerId, UINT8 Start){
  UINT8 v3; 
  UINT8 v5; 
  unsigned int v6; 
  UINT8 v8; 
  INT64 v9; 
  UINT8 v10; 
  UINT64 v11; 
  unsigned int v12; 
  int v13; 
  unsigned int v14; 
  unsigned int v15; 
  unsigned int v16; 
  char a3[56]; 
  unsigned int v18; 
  v18 = Start;
  v5 = v3;
  a3[0] = 0;
  v6 = Start;
  v8 = IoSetThreadHardErrorMode(0);
  v9 = EtwpOpenLogger(v6, LoggerId, 0, a3);
  v11 = v9;
  if( v9 )
  {
    if( GroupMasks )
    {
      if( (GroupMasks->Masks[1] & 0x20) != 0 && !v5 )
        EtwpLogRefSetAutoMark(0, v9);
      v12 = GroupMasks->Masks[0];
      if( (GroupMasks->Masks[0] & 0xC004) != 0
        || (GroupMasks->Masks[4] & 0x40) != 0
        || (v12 & 1) != 0
        || (v12 & 2) != 0
        || (GroupMasks->Masks[1] & 0x8000000) != 0 )
      {
        EtwpProcessThreadImageRundown(GroupMasks, v11, v5);
        v12 = GroupMasks->Masks[0];
      }
      v13 = v12 & 0x20000;
      if( v13 || (GroupMasks->Masks[2] & 0x1000000) != 0 )
        CmEtwRunDown(LoggerId, v6, v13 != 0, HIBYTE(GroupMasks->Masks[2]) & 1);
      v14 = GroupMasks->Masks[1];
      if( (v14 & 2) != 0 )
      {
        EtwpSampledProfileRunDown(v11, v5, 1u);
        v14 = GroupMasks->Masks[1];
      }
      if( (v14 & 0x400) != 0 )
      {
        EtwpSampledProfileRunDown(v11, v5, 0);
        v14 = GroupMasks->Masks[1];
      }
      if( (v14 & 0x10000) != 0 )
      {
        EtwpSpinLockConfigRunDown(v11, v5);
        v14 = GroupMasks->Masks[1];
      }
      if( (v14 & 0x20000) != 0 )
      {
        EtwpExecutiveResourceConfigRunDown(v11, v5);
        v14 = GroupMasks->Masks[1];
      }
      if( (v14 & 0x400008) != 0 )
      {
        MmPerfLogSessionRundown(LoggerId, v6);
        v14 = GroupMasks->Masks[1];
      }
      if( (v14 & 0x8000049) != 0 )
        EtwpPoolRunDown(v11, v5);
      if( (GroupMasks->Masks[2] & 0x100000) != 0 )
        EtwpClockSourceRunDown(v11, v5);
      v15 = GroupMasks->Masks[1];
      if( v5 )
      {
        if( (v15 & 0x8000000) != 0 )
        {
          MmIdentifyPhysicalMemory(LoggerId, v6, 0x285ui64);
          MmLogSystemShareablePfnInfo(LoggerId, (PVOID)v6);
          v15 = GroupMasks->Masks[1];
        }
        if( (v15 & 0x20) != 0 )
          EtwpLogRefSetAutoMark(v5, v11);
      }
      else
      {
        if( (v15 & 0x8000000) != 0 )
        {
          MmLogSystemShareablePfnInfo(LoggerId, (PVOID)v6);
          MmIdentifyPhysicalMemory(LoggerId, v6, 0x285ui64);
          v15 = GroupMasks->Masks[1];
        }
        if( (v15 & 9) != 0 )
        {
          EtwpLogMemInfoRundown(v11);
          MmIdentifyPhysicalMemory(LoggerId, v6, 0x223ui64);
          v15 = GroupMasks->Masks[1];
        }
        if( (v15 & 0x80000) != 0 )
        {
          MmLogQueryCombineStats(LoggerId, (int *)&v18, 0i64);
          v6 = v18;
        }
        if( (GroupMasks->Masks[0] & 0x200) != 0 )
          WmiTraceRundownNotify(**(_QWORD **)(v11 + 1080), v6);
        v16 = GroupMasks->Masks[4];
        if( (v16 & 0x8000) != 0 )
        {
          PopExecuteOnTargetProcessors((INT64)&KeActiveProcessors, (INT64)PpmTracePerfIdleRundown, 0i64, 0i64);
          v16 = GroupMasks->Masks[4];
        }
        if( (v16 & 0x40) != 0 || (v16 & 0x80u) != 0 )
          EtwpObjectTypeRundown(v11, 0);
        if( (GroupMasks->Masks[2] & 0x10000) != 0 )
          EtwpProcessorRundown(v11, v10);
      }
    }
    EtwpCloseLogger(v6, LoggerId, a3[0]);
  }
  IoSetThreadHardErrorMode(v8);
}

Referenced by: