EtwpCoverageCheckCP

NTSTATUS __stdcall EtwpCoverageCheckCP(INT64 a1, INT64 a2){
  NTSTATUS v4; 
  _ETHREAD *CurrentThread; 
  __int64 v6; 
  INT64 v7; 
  UINT64 *Internal; 
  int v9; 
  int v11; 

  v4 = 0;
  v11 = 0;
  if( (unsigned int)EtwpCoverageValidateCP((_BYTE **)a2, &v11) )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)&ExBootDevicesRemovedEvent + 166, 0i64);
    v6 = *(_QWORD *)(a1 + 16);
    v7 = *(unsigned int *)(a2 + 8);
    qword_140C50300 = (__int64)KeGetCurrentThread();
    Internal = TelemetryCoverageTableLocateInternal((UINT64 *)v6, v7);
    if( *(_DWORD *)Internal == v9 )
    {
      v4 = 1;
      *(_DWORD *)(a2 + 12) = *(_DWORD *)(v6 + 24);
    }
    else
    {
      *(_DWORD *)(a2 + 12) = 0;
    }
  }
  if( (struct _KTHREAD *)qword_140C50300 == KeGetCurrentThread() )
  {
    qword_140C50300 = 0i64;
    if( (_InterlockedExchangeAdd64((_QWORD *)&ExBootDevicesRemovedEvent + 166, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((_EX_PUSH_LOCK *)&ExBootDevicesRemovedEvent + 166);
    KeAbPostRelease((char *)&ExBootDevicesRemovedEvent + 1328);
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
  }
  return v4;
}

Referenced by: