EtwpCoverageEnsureUserModeView

INT64 __fastcall EtwpCoverageEnsureUserModeView(INT64 a1){
  UINT64 v1; 
  __int64 v2; 
  _ETHREAD *CurrentThread; 
  __int64 v4; 
  __int64 *v5; 
  char v6; 
  int v8; 
  v1 = *((_QWORD *)KeGetCurrentThread() + 23);
  v2 = *(_QWORD *)(v1 + 1360);
  if( *(_QWORD *)(v2 + 1952) )
  {
    v8 = 0;
  }
  else
  {
    v8 = MmMapViewOfSection(*(_LOADER_PARAMETER_BLOCK **)(a1 + 8), v1);
    if( v8 >= 0 )
    {
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --*((_WORD *)CurrentThread + 242);
      ExAcquirePushLockExclusiveEx((UINT64)&EtwpCoverageLock, 0i64);
      EtwpCoverageLockOwner = (__int64)KeGetCurrentThread();
      if( !*(_QWORD *)(v2 + 1952) )
        *(_QWORD *)(v2 + 1952) = 0i64;
      v4 = 0i64;
      v5 = *(__int64 **)(v1 + 1408);
      if( v5 )
        v4 = *v5;
      if( v4 )
        *(_DWORD *)(v4 + 1116) = *(_DWORD *)(v2 + 1952);
      v8 = 0;
    }
  }
  if( (struct _KTHREAD *)EtwpCoverageLockOwner == KeGetCurrentThread() )
  {
    EtwpCoverageLockOwner = 0i64;
    v6 = _InterlockedExchangeAdd64((volatile signed __int64 *)&EtwpCoverageLock, 0xFFFFFFFFFFFFFFFFui64);
    if( (v6 & 2) != 0 && (v6 & 4) == 0 )
      ExfTryToWakePushLock((volatile INT64 *)&EtwpCoverageLock);
    KeAbPostRelease(&EtwpCoverageLock);
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  }
  return(unsigned int)v8;
}

Referenced by: