PerfDiagpProxyWorker

VOID __stdcall PerfDiagpProxyWorker(PVOID Parameter){
  int v1; 
  _ETHREAD *CurrentThread; 
  INT64 v3; 
  const wchar_t *v4; 
  int updated; 
  char v6; 
  const wchar_t *v7; 
  UINT64 OutBufferLen; 
  UINT64 ReturnLength; 
  if( !Parameter )
    return;
  LODWORD(ReturnLength) = 0;
  v1 = *((_DWORD *)Parameter + 8);
  ExFreePoolWithTag(Parameter, 0);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  ExAcquirePushLockExclusiveEx((UINT64)&qword_140C1A040, 0i64);
  if( !(unsigned int)PerfDiagpIsTracingAllowed() )
    goto LABEL_30;
  if( dword_140C1A048 != v1 - 1 )
  {
    if( v1 == 3 )
    {
      if( dword_140C1A048 == 1 )
        goto LABEL_11;
    }
    else if( ((v1 - 5) & 0xFFFFFFFD) == 0 )
    {
      goto LABEL_4;
    }
    if( v1 < dword_140C1A048 )
    {
      v1 = dword_140C1A048;
      goto LABEL_11;
    }
LABEL_30:
    dword_140C1A048 = 8;
    goto LABEL_12;
  }
LABEL_4:
  if( v1 == 1 )
  {
    v7 = L"Diagnostics\\Performance\\BootCKCLSettings";
  }
  else
  {
    v3 = (unsigned int)(v1 - 2);
    if( v1 == 2 )
    {
      v4 = (const wchar_t *)L"WaitingForLogonEnableKernelFlags";
      goto LABEL_9;
    }
    v3 = (unsigned int)(v1 - 3);
    switch( v1 )
    {
      case 3:
        v4 = L"EnableKernelFlags";
LABEL_9:
        updated = PerfDiagpUpdatePerfDiagLoggerEnableFlags(v3, (INT64)v4);
        goto LABEL_10;
      case 4:
LABEL_16:
        PerfDiagpInitializeLoggerInfo(0i64, 0i64);
        LODWORD(OutBufferLen) = OutBuffer;
        NtTraceControl(2ui64, &OutBuffer, (unsigned int)OutBuffer, &OutBuffer, OutBufferLen, &ReturnLength);
        goto LABEL_11;
      case 5:
        v7 = L"Diagnostics\\Performance\\SecondaryLogonCKCLSettings";
        break;
      case 6:
        goto LABEL_16;
      case 7:
        PerfDiagpSaveActiveDCLLogFileName();
        v7 = L"Diagnostics\\Performance\\ShutdownCKCLSettings";
        break;
      default:
        goto LABEL_11;
    }
  }
  updated = PerfDiagpStartPerfDiagLogger(v7);
LABEL_10:
  if( updated < 0 )
    goto LABEL_30;
LABEL_11:
  dword_140C1A048 = v1;
LABEL_12:
  v6 = _InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C1A040, 0xFFFFFFFFFFFFFFFFui64);
  if( (v6 & 2) != 0 && (v6 & 4) == 0 )
    ExfTryToWakePushLock((volatile INT64 *)&qword_140C1A040);
  KeAbPostRelease(&qword_140C1A040);
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
}

Referenced by: