You can inspect each thread's call stack with Process Explorer. That's not a
real accurate trace of the thread's execution, but it will give you a rough idea of what the thread is presently doing in most cases. It's as good as you're going to get without knowing your way around a debugger, anyway. If you install the Debugging Tools for Windows and configure symbols, you'll get function names (plus offsets) instead of raw virtual addresses inside of system libraries/executables. It's hard to tell what's going on without some API names.
If I had to make a wild-ass guess, you probably have on-board audio, don't you? Built-in audio codecs are almost always software devices. Only the codec interface itself is implemented in hardware. For instance, if you look at the driver structure for on-board audio devices, they usually call for the installation of the kernel audio mixer device (kmixer.sys). This is a software device for mixing audio streams in kernel mode.
On-board audio devices are known to eat up potentially 5-10% of a processor's resources under heavy load, depending on the processor and the particular codec & drivers. This probably takes place in separate worker threads for technical reasons. That might account for what you're seeing. That said, 35% on a quad core means you're eating up about 60% of the second core.... At first glance, that sounds excessive for simple audio mixing, or even EAX effects (which I don't think DF uses
). Then again, multi-core systems are not strictly additive. A quad-core system doesn't really have 4x the processing power of an identical single core system, even with optimally threaded code. So 60% of a core isn't quite as bad as it sounds.
In short, I have no idea. Is the DF music MP3 encoded? Maybe it spawns a worker thread to decode the MP3 stream. Between decoding an MP3 stream and kernel mixing, it might be a plausible explanation.
Maybe you can post some call stacks and I can figure it out.
Do configure symbols first, though. Calls like "kernel32!0x77123456" are meaningless since system DLLs are routinely loaded at different base virtual addresses on each system, or sometimes even for each process.