EtwpLogContextSwapEvent

VOID __fastcall EtwpLogContextSwapEvent(INT64 rcx0, INT64 rdx0, INT64 a3){
  unsigned int v3; 
  bool v4; 
  __int64 v5; 
  int v9; 
  __int64 v10; 
  __int64 v11; 
  INT64 v12; 
  int v13; 
  LARGE_INTEGER LoggerTimeStamp; 
  unsigned int v15; 
  int v16; 
  int v17; 
  INT64 v18; 
  unsigned int v19; 
  __int64 v20; 
  INT64 v21; 
  struct _KPRCB *CurrentPrcb; 
  __int64 v23; 
  __int64 v24; 
  __int64 v25; 
  unsigned int v26; 
  __int64 v27; 
  unsigned int v28; 
  __int64 v29; 
  INT64 a1[2]; 
  __int64 v31; 
  INT64 a2; 
  v3 = *(_DWORD *)(rcx0 + 4224);
  a2 = 0i64;
  v4 = !_BitScanForward((unsigned int *)&v5, v3);
  *(_OWORD *)a1 = 0i64;
  v31 = 0i64;
  v9 = 0;
  while( !v4 )
  {
    v3 &= v3 - 1;
    v10 = 32i64 * (unsigned int)v5;
    v11 = v10 + rcx0 + 4260;
    if( !v11 || (*(_DWORD *)(v11 + 4) & 4) == 0 )
      goto LABEL_14;
    if( (unsigned int)*(unsigned __int8 *)(rcx0 + 2 * v5 + 4208) >= *(_DWORD *)(rcx0 + 16) )
    {
      v12 = 1i64;
    }
    else
    {
      _mm_lfence();
      v12 = *(_QWORD *)(*(_QWORD *)(rcx0 + 456) + 8i64 * *(unsigned __int8 *)(rcx0 + 2 * v5 + 4208));
    }
    if( (v12 & 1) != 0 )
      goto LABEL_14;
    if( (*(_DWORD *)(v10 + rcx0 + 4264) & 0x100) != 0 )
    {
      v13 = 1 << *(_DWORD *)(v12 + 216);
      if( (~v9 & v13) != 0 )
      {
        LoggerTimeStamp = EtwpGetLoggerTimeStamp(v12);
        v15 = *(_DWORD *)(v12 + 216);
        a2 = LoggerTimeStamp.QuadPart;
        EtwpCCSwapTrace(rdx0, a3, v15, (struct _KPRCB **)&a2);
        v9 |= v13;
      }
LABEL_10:
      if( a3 )
      {
        v16 = *(_DWORD *)(v12 + 832);
        if( (v16 & 0x80u) != 0 && _bittest((const signed __int32 *)(*(_QWORD *)(v12 + 984) + 164i64), 4u) )
        {
          EtwpStackTraceDispatcher(v12, &a2, a3, 0x405A04u);
          v16 = *(_DWORD *)(v12 + 832);
        }
        if( (v16 & 0x8000) != 0 )
        {
          v26 = 0;
          if( *(_DWORD *)(*(_QWORD *)(v12 + 1008) + 8i64) )
          {
            while( 1 )
            {
              v27 = *(_QWORD *)(v12 + 1008);
              if( *(_WORD *)(v27 + 2i64 * v26 + 12) == 1316 )
                break;
              if( ++v26 >= *(_DWORD *)(v27 + 8) )
                goto LABEL_13;
            }
            EtwpTraceLastBranchRecord((UINT64 *)v12, &a2, (_ETHREAD *)a3, 4217348i64);
          }
        }
LABEL_13:
        if( (*(_DWORD *)(v12 + 832) & 0x4000000) != 0 )
        {
          v28 = 0;
          if( *(_DWORD *)(*(_QWORD *)(v12 + 1016) + 24i64) )
          {
            while( 1 )
            {
              v29 = *(_QWORD *)(v12 + 1016);
              if( *(_WORD *)(v29 + 2i64 * v28 + 28) == 1316 )
                break;
              if( ++v28 >= *(_DWORD *)(v29 + 24) )
                goto LABEL_14;
            }
            EtwpTraceProcessorTrace((VOID **)v12, (UINT64)&a2);
          }
        }
      }
      goto LABEL_14;
    }
    v17 = *(_DWORD *)(v12 + 832);
    if( (v17 & 0xC00) == 0 )
      goto LABEL_24;
    if( (v17 & 0x400) != 0 )
    {
      v18 = EtwpReserveWithPebsIndex((UINT64 *)v12, 1316, 24i64, (INT64)a1, &a2, 23044);
      goto LABEL_26;
    }
    if( (v17 & 0x800) != 0 && (v19 = 0, *(_DWORD *)(*(_QWORD *)(v12 + 1000) + 8i64)) )
    {
      while( 1 )
      {
        v20 = *(_QWORD *)(v12 + 1000);
        if( *(_WORD *)(v20 + 2i64 * v19 + 12) == 1316 )
          break;
        if( ++v19 >= *(_DWORD *)(v20 + 8) )
          goto LABEL_24;
      }
      v18 = EtwpReserveWithPmcCounters(v12, 1316, 24i64, (INT64)a1, &a2, 23044);
    }
    else
    {
LABEL_24:
      v21 = EtwpReserveTraceBuffer((UINT64 *)v12, 40i64, (INT64)a1, &a2, 23044);
      if( !v21 )
        goto LABEL_14;
      v18 = v21 + 16;
      *(_QWORD *)(v21 + 8) = a2;
      *(_DWORD *)v21 = -1072627708;
      *(_DWORD *)(v21 + 4) = 86245416;
    }
LABEL_26:
    if( v18 )
    {
      *(_OWORD *)v18 = 0i64;
      *(_QWORD *)(v18 + 16) = 0i64;
      if( rdx0 )
      {
        *(_DWORD *)(v18 + 4) = *(_DWORD *)(rdx0 + 1152);
        *(_BYTE *)(v18 + 9) = *(_BYTE *)(rdx0 + 195);
        *(_BYTE *)(v18 + 12) = *(_BYTE *)(rdx0 + 643);
        *(_BYTE *)(v18 + 13) ^= (*(_BYTE *)(v18 + 13) ^ *(_BYTE *)(rdx0 + 391)) & 1;
        *(_BYTE *)(v18 + 14) = *(_BYTE *)(rdx0 + 388);
        *(_BYTE *)(v18 + 15) = *(_BYTE *)(rdx0 + 588);
        *(_BYTE *)(v18 + 13) ^= (*(_BYTE *)(v18 + 13) ^ (2 * *(_BYTE *)(rdx0 + 512))) & 0xE;
        *(_DWORD *)(v18 + 20) = (*(_QWORD *)(rdx0 + 32) - *(_QWORD *)(rdx0 + 72)) >> 10;
        CurrentPrcb = KeGetCurrentPrcb();
        if( rdx0 == *((_QWORD *)CurrentPrcb + 3) )
        {
          v23 = *((_QWORD *)CurrentPrcb + 4096);
          if( v23 )
            *(_BYTE *)(v18 + 10) = *(_BYTE *)(v23 + 20);
        }
        else
        {
          v24 = *(_QWORD *)(rdx0 + 104);
          if( v24 )
          {
            v25 = v24 + *((unsigned int *)CurrentPrcb + 54);
            while( 1 )
            {
              LODWORD(v24) = *(_DWORD *)(v25 + 116);
              if( (unsigned int)v24 > 0xFF )
                break;
              if( !(_BYTE)v24 )
              {
                v25 = *(_QWORD *)(v25 + 408);
                if( v25 )
                  continue;
              }
              goto LABEL_39;
            }
            LOBYTE(v24) = -1;
          }
LABEL_39:
          *(_BYTE *)(v18 + 10) = v24;
        }
      }
      if( a3 )
      {
        *(_DWORD *)v18 = *(_DWORD *)(a3 + 1152);
        *(_BYTE *)(v18 + 8) = *(_BYTE *)(a3 + 195);
        *(_BYTE *)(v18 + 11) = *(_BYTE *)(a3 + 564);
        *(_BYTE *)(v18 + 13) ^= (*(_BYTE *)(v18 + 13) ^ (16 * *(_BYTE *)(a3 + 512))) & 0x70;
        *(_DWORD *)(v18 + 16) = KUSER_SHARED_DATA.TickCount.LowPart - *(_DWORD *)(a3 + 436);
      }
      EtwpReleaseTraceBuffer(a1);
      goto LABEL_10;
    }
LABEL_14:
    v4 = !_BitScanForward((unsigned int *)&v5, v3);
  }
}

Referenced by: