EtwpCovSampContextFastFindModule

NTSTATUS __stdcall EtwpCovSampContextFastFindModule(INT64 a1, INT64 a2, INT64 *a3){
  int v3; 
  INT64 v4; 
  __int64 v5; 
  __int64 v6; 
  __int64 v8; 

  v3 = *(_DWORD *)(a1 + 684) >> 5;
  v4 = 0i64;
  v5 = -1i64 << (*(_BYTE *)(a1 + 684) & 0x1F);
  v6 = v5 & *(_QWORD *)a2;
  if( !v3 )
    return 0;
  v8 = *(_QWORD *)(a1 + 688)
     + 8i64
     * ((37
       * (BYTE6(v6)
        + 37
        * (BYTE5(v6)
         + 37
         * (BYTE4(v6) + 37 * (BYTE3(v6) + 37 * (BYTE2(v6) + 37 * (BYTE1(v6) + 37 * ((unsigned __int8)v6 + 11623883)))))))
       + HIBYTE(v6)) & (unsigned int)(v3 - 1));
  while( 1 )
  {
    v8 = *(_QWORD *)v8;
    if( (v8 & 1) != 0 )
      break;
    if( v6 == (v5 & *(_QWORD *)(v8 + 8)) )
      goto LABEL_7;
  }
  v8 = 0i64;
LABEL_7:
  if( !v8 )
    return 0;
  if( *(_DWORD *)(v8 + 32) == *(_DWORD *)(a2 + 16)
    && *(_DWORD *)(v8 + 36) == *(_DWORD *)(a2 + 20)
    && *(_QWORD *)(v8 + 40) == *(_QWORD *)(a2 + 8)
    && *(_DWORD *)(v8 + 160) == *(_DWORD *)(a2 + 24) )
  {
    *(_DWORD *)(v8 + 136) = KUSER_SHARED_DATA.TickCount.LowPart;
    if( _InterlockedIncrement64((volatile signed __int64 *)(v8 + 64)) <= 1 )
      __fastfail(0xEu);
    v4 = v8;
  }
  *a3 = v4;
  return v8;
}

Referenced by: