EtwpCovSampCaptureApc

_ETHREAD *__fastcall EtwpCovSampCaptureApc(__int64 a1, _QWORD *a2, __int64 *a3, UINT64 *a4){
  __int64 v4; 
  __int64 v5; 
  UINT64 v6; 
  unsigned __int8 v7; 
  unsigned __int64 v8; 
  INT64 v9; 
  INT64 v10; 
  _ETHREAD *result; 
  int v12[14]; 
  int v13; 

  v13 = 0;
  v4 = a1 - 56;
  v5 = *a3;
  v6 = *a4;
  *a2 = 0i64;
  _InterlockedOr(v12, 0);
  if( *(_DWORD *)(*(_QWORD *)(a1 - 56 + 48) + 40i64) )
  {
    v7 = KeAcquireSpinLockRaiseToDpc((UINT64 *)(v5 + 264));
    *(_QWORD *)(v4 + 64) = 0i64;
    v8 = v7;
    KxReleaseSpinLock((UINT64 *)(v5 + 264));
    __writecr8(v8);
  }
  v9 = *(&ExBootDevicesRemovedEvent + 153);
  memset((VOID *)(v4 + 56), 0i64, 0x58u);
  v10 = *(_QWORD *)(v4 + 48);
  *(_DWORD *)(v4 + 144) = 0;
  EtwpCovSampCaptureReleaseToLookaside(v9, v10, (PFN_WDFUSBTARGETDEVICECREATE *)v4);
  if( EtwpCovSampSafeForUserAddressCapture(1i64, (BOOL *)&v13) >= 0 && !v13 )
    EtwpCovSampCaptureUserAddresses((INT64 *)v5, v6);
  result = (_ETHREAD *)KeGetCurrentThread();
  _InterlockedAnd((volatile signed __int32 *)&result->1296, 0xFF7FFFFF);
  return result;
}

Referenced by: