EtwQueryProcessTelemetryCoverage

UINT8 __stdcall EtwQueryProcessTelemetryCoverage(_ERESOURCE *Resource, UINT8 Wait){
  size_t v2; 
  size_t *v3; 
  size_t *v4; 
  size_t v5; 
  VOID *v6; 
  _ETHREAD *CurrentThread; 
  INT64 v8; 
  size_t v9; 
  __int64 *v10; 
  __int64 *i; 
  _DWORD *v12; 
  size_t v13; 
  __int64 v14; 
  __int64 *j; 
  size_t v16; 
  __int64 v17; 
  UINT8 v19; 

  v4 = v3;
  v5 = v2;
  v6 = (VOID *)Wait;
  if( Resource == (_ERESOURCE *)KeGetCurrentThread()->ApcState.Process )
  {
    if( EtwpCoverageContext )
    {
      if( EtwpCoverageUserIsAdmin() )
      {
        CurrentThread = (_ETHREAD *)KeGetCurrentThread();
        --CurrentThread->Tcb.KernelApcDisable;
        ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)&ExBootDevicesRemovedEvent + 166, 0i64);
        qword_140C50300 = (__int64)KeGetCurrentThread();
        v8 = EtwpCoverageContext;
        v9 = *(_DWORD *)(*(_QWORD *)(EtwpCoverageContext + 16) + 16i64);
        v10 = (__int64 *)(EtwpCoverageContext + 48);
        for( i = *(__int64 **)(EtwpCoverageContext + 48); i != v10; i = (__int64 *)*i )
          v9 = *((_DWORD *)i + 6) - (_DWORD)i + v9 - 40;
        if( v4 )
          *v4 = v9;
        v12 = *(_DWORD **)(v8 + 16);
        v13 = v12[4];
        if( v5 < v13 )
          v13 = v5;
        if( v13 )
        {
          v14 = v13;
          memmove(v6, v12, v13);
          v6 = (char *)v6 + v14;
        }
        if( v5 < v9 )
        {
          v19 = 5;
        }
        else
        {
          for( j = (__int64 *)*v10; j != v10; j = (__int64 *)*j )
          {
            v16 = *((_DWORD *)j + 6) - (_DWORD)j - 40;
            if( *((_DWORD *)j + 6) - (_DWORD)j != 40 )
            {
              v17 = v16;
              memmove(v6, j + 5, v16);
              v6 = (char *)v6 + v17;
            }
          }
          v19 = 0;
        }
      }
      else
      {
        v19 = 34;
      }
    }
    else
    {
      v19 = -73;
    }
  }
  else
  {
    v19 = -69;
  }
  if( (struct _KTHREAD *)qword_140C50300 == KeGetCurrentThread() )
  {
    qword_140C50300 = 0i64;
    if( (_InterlockedExchangeAdd64((_QWORD *)&ExBootDevicesRemovedEvent + 166, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((_EX_PUSH_LOCK *)&ExBootDevicesRemovedEvent + 166);
    KeAbPostRelease((char *)&ExBootDevicesRemovedEvent + 1328);
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
  }
  return v19;
}

Referenced by: