EtwpCovSampImageNotify

VOID __stdcall EtwpCovSampImageNotify(PUNICODE_STRING FullImageName, HANDLE ProcessId, PIMAGE_INFO ImageInfo){
  PVOID *v3; 
  ULONG *p_ImageSectionNumber; 
  _ETHREAD *CurrentThread; 
  INT64 v9; 
  INT64 v10; 
  INT64 v11; 
  __int64 v12; 
  v3 = 0i64;
  v11 = 0i64;
  v12 = 0i64;
  if( (ImageInfo->Properties & 0x400) == 0 )
    return;
  p_ImageSectionNumber = &ImageInfo[-1].ImageSectionNumber;
  if( (int)EtwpCovSampAcquireSamplerRundown(&v12) >= 0 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    v3 = (PVOID *)(qword_140C196B8 + 16);
    v9 = *((_QWORD *)CurrentThread + 23);
    if( ProcessId )
    {
      if( ProcessId == *(HANDLE *)(v9 + 1088)
        && (int)EtwpCovSampProcessEnsureContext(*((_QWORD *)CurrentThread + 23)) >= 0 )
      {
        v10 = *(_QWORD *)(v9 + 2544);
        goto LABEL_9;
      }
    }
    else if( (ImageInfo->Properties & 0x100) != 0 )
    {
      v10 = qword_140C196B8 + 752;
LABEL_9:
      if( (int)EtwpCovSampContextGetModule((INT64)v3, v9, v10, FullImageName, (INT64)p_ImageSectionNumber, &v11) >= 0 )
        EtwpCovSampProcessAddModule(v10, v3, v11, (UINT64)ImageInfo->ImageBase);
    }
  }
  if( v11 )
    EtwpCovSampModuleDereference((INT64)v3, v11);
  if( v12 )
  {
    ExReleaseRundownProtection((PEX_RUNDOWN_REF)&stru_140C196C0);
    KeLeaveCriticalRegion();
  }
}

Referenced by: