NtStartProfile

NTSTATUS __stdcall NtStartProfile(PVOID ProfileHandle){
  KPROCESSOR_MODE v1; 
  NTSTATUS result; 
  PADAPTER_OBJECT v3; 
  NTSTATUS v4; 
  UINT64 v5; 
  char *PoolWithTag; 
  void *v7; 
  _MDL *v8; 
  __int64 v9; 
  _DMA_OPERATIONS *DmaOperations; 
  PVOID v11; 
  INT64 Priority; 
  INT64 v13; 
  PADAPTER_OBJECT DmaAdapter; 
  PVOID P; 
  v1 = *((_BYTE *)KeGetCurrentThread() + 562);
  DmaAdapter = 0i64;
  result = ObReferenceObjectByHandle(ProfileHandle, 1u, ExProfileObjectType, v1, (PVOID *)&DmaAdapter, 0i64);
  if( result >= 0 )
  {
    KeWaitForSingleObject(&ExpProfileStateMutex, Executive, 0, 0, 0i64);
    v3 = DmaAdapter;
    if( *(_QWORD *)&DmaAdapter[3].Version )
    {
      v4 = -1073741640;
LABEL_8:
      KeReleaseMutex(&ExpProfileStateMutex, 0);
      HalPutDmaAdapter(v3);
      return v4;
    }
    if( ExpCurrentProfileUsage == (unsigned int)KeQueryActiveProcessorCountEx(0xFFFFu) << 13 )
    {
      v4 = -1073741613;
      goto LABEL_8;
    }
    v5 = MmSizeOfMdl(v3[1].DmaOperations, *(unsigned int *)&v3[2].Version);
    PoolWithTag = (char *)ExAllocatePoolWithTag(NonPagedPoolNx, v5 + 248, 0x666F7250ui64);
    v7 = PoolWithTag;
    P = PoolWithTag;
    if( !PoolWithTag )
    {
      v4 = -1073741670;
      goto LABEL_8;
    }
    v8 = (_MDL *)(PoolWithTag + 248);
    v3[3].DmaOperations = (_DMA_OPERATIONS *)(PoolWithTag + 248);
    v3[2].DmaOperations = (_DMA_OPERATIONS *)PoolWithTag;
    v9 = *(unsigned int *)&v3[2].Version;
    DmaOperations = v3[1].DmaOperations;
    *((_QWORD *)PoolWithTag + 31) = 0i64;
    *((_WORD *)PoolWithTag + 128) = 8
                                  * ((((unsigned __int64)((unsigned __int16)DmaOperations & 0xFFF) + v9 + 4095) >> 12)
                                   + 6);
    *((_WORD *)PoolWithTag + 129) = 0;
    *((_QWORD *)PoolWithTag + 35) = (unsigned __int64)DmaOperations & 0xFFFFFFFFFFFFF000ui64;
    *((_DWORD *)PoolWithTag + 73) = (unsigned __int16)DmaOperations & 0xFFF;
    *((_DWORD *)PoolWithTag + 72) = v9;
    MmProbeAndLockPages((_MDL *)(PoolWithTag + 248), v1, IoWriteAccess);
    v11 = MmMapLockedPagesSpecifyCache((PMDL)v3[3].DmaOperations, 0, MmCached, 0i64, 0, 0x40000010u);
    if( v11 )
    {
      LODWORD(v13) = *(_DWORD *)&v3[4].Version;
      LODWORD(Priority) = *(_DWORD *)(&v3[2].Size + 1);
      KeInitializeProfile(
        (INT64)v7,
        *(_QWORD *)&v3->Version,
        (INT64)v11,
        (INT64)v3->DmaOperations,
        *(_QWORD *)&v3[1].Version,
        Priority,
        v13,
        *(_DWORD *)(&v3[4].Size + 1),
        (UINT16 *)&v3[4].DmaOperations);
      KeStartProfile((ULONG_PTR)v7);
      *(_QWORD *)&v3[3].Version = v11;
      ++ExpCurrentProfileUsage;
      KeReleaseMutex(&ExpProfileStateMutex, 0);
      HalPutDmaAdapter(v3);
      return 0;
    }
    else
    {
      KeReleaseMutex(&ExpProfileStateMutex, 0);
      MmUnlockPages(v8);
      ExFreePoolWithTag(v7, 0);
      HalPutDmaAdapter(v3);
      return -1073741670;
    }
  }
  return result;
}

Referenced by: