EtwpProfileInterrupt

VOID __stdcall EtwpProfileInterrupt(KTRAP_FRAME *TrapFrame, PVOID Context){
  _ETHREAD *CurrentThread; 
  unsigned __int64 Rip; 
  int v4; 
  int v5; 
  __int64 v6; 
  char v7; 
  struct _KPRCB *CurrentPrcb; 
  unsigned __int8 v9; 
  char v10; 
  __int64 v11; 
  __int64 v12; 
  INT64 a6; 
  unsigned __int64 v14; 
  int v15; 
  __int16 v16; 
  char v17; 
  char v18; 
  EVENT_DATA_DESCRIPTOR a2; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  Rip = TrapFrame->Rip;
  v4 = 34656770;
  v5 = *((_DWORD *)CurrentThread + 288);
  if( Rip > 0x7FFFFFFEFFFFi64 )
    v4 = 34658818;
  v6 = *((_QWORD *)CurrentThread + 68);
  v17 = 0;
  v15 = v5;
  v7 = 8 * *((_BYTE *)CurrentThread + 195);
  v17 = v7;
  v14 = Rip;
  v16 = 1;
  CurrentPrcb = KeGetCurrentPrcb();
  v9 = *((_BYTE *)CurrentPrcb + 32);
  if( v9 != 2 )
  {
    if( v9 <= 1u )
      goto LABEL_9;
    goto LABEL_7;
  }
  if( (*((_DWORD *)KeGetPcr() + 3243) & 0x10001) == 0 )
  {
LABEL_7:
    v10 = v7 | 2;
    goto LABEL_8;
  }
  v10 = v7 | 1;
LABEL_8:
  v4 &= ~0x4000u;
  v17 = v10;
LABEL_9:
  v11 = *((_QWORD *)CurrentThread + 13);
  if( v11 )
  {
    v12 = v11 + *((unsigned int *)CurrentPrcb + 54);
    do
    {
      if( *(_DWORD *)(v12 + 116) > 0xFFu )
        LOBYTE(v11) = -1;
      else
        LOBYTE(v11) = *(_BYTE *)(v12 + 116);
      if( (_BYTE)v11 )
        break;
      v12 = *(_QWORD *)(v12 + 408);
    }
    while( v12 );
  }
  a2.Reserved = 0;
  a2.Ptr = (unsigned __int64)&v14;
  v18 = v11;
  LODWORD(a6) = v4;
  a2.Size = 16;
  EtwTraceSiloKernelEvent(*(_QWORD *)(v6 + 2160), &a2, 1u, 0x20000002ui64, 3886, a6);
}

Referenced by: