EtwpLocateDbgIdForRegEntry

INT64 __fastcall EtwpLocateDbgIdForRegEntry(CHAR a1, INT64 a2, UINT8 **a3, UINT64 *a4){
  void *v6; 
  _ETHREAD *CurrentThread; 
  INT64 result; 
  UINT64 v9; 
  ULONGLONG Size; 
  PVOID BaseOfImage; 
  PIMAGE_NT_HEADERS NtHeader; 
  INT64 v13; 
  LODWORD(v13) = 0;
  NtHeader = 0i64;
  BaseOfImage = 0i64;
  Size = 0i64;
  v6 = *(void **)(a2 + 88);
  if( !v6 )
    return 3221225793i64;
  if( !a1 )
  {
    RtlPcToFileHeader(v6, &BaseOfImage);
    if( !BaseOfImage )
      return 3221226021i64;
LABEL_5:
    LODWORD(result) = RtlImageNtHeaderEx(
                        1ui64,
                        (PVOID)((unsigned __int64)BaseOfImage & 0xFFFFFFFFFFFFFFFCui64),
                        Size,
                        &NtHeader);
    if( (int)result >= 0 )
    {
      v9 = Size;
      if( !Size )
      {
        LODWORD(result) = EtwpGetImageSize(NtHeader, &Size);
        v9 = Size;
      }
      if( (int)result >= 0 )
      {
        if( a1 == 1
          && v9
          && ((unsigned __int64)BaseOfImage + v9 > 0x7FFFFFFF0000i64 || (char *)BaseOfImage + v9 < BaseOfImage) )
        {
          MEMORY[0x7FFFFFFF0000] = 0;
          v9 = Size;
        }
        return EtwpFindDebugId(BaseOfImage, v9, 0i64, (UINT64 *)a3);
      }
    }
    return result;
  }
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  if( (*(_BYTE *)(*((_QWORD *)CurrentThread + 23) + 992i64) & 1) != 0 )
    return VslGetEtwDebugId(*((_QWORD *)CurrentThread + 23), *(_QWORD *)(a2 + 88), (INT64 *)a3, a4);
  result = MmGetImageInformation((UINT64)v6, &BaseOfImage, &Size, &v13);
  if( (int)result >= 0 )
    goto LABEL_5;
  return result;
}

Referenced by: