EtwpGetStackExtendedHeaderItem

VOID __fastcall EtwpGetStackExtendedHeaderItem(INT64 a1, CHAR a2, UINT64 a3, INT64 a4, CHAR a5, INT64 *a6){
  __int64 v6; 
  __int64 v7; 
  __int16 v8; 
  INT64 v9; 
  int v11; 
  unsigned int v14; 
  UINT8 CurrentIrql; 
  int v16; 
  __int16 v17; 
  __int16 v18; 
  v6 = 0i64;
  v7 = *(_QWORD *)a4 + 16i64;
  v8 = 0;
  v9 = 0i64;
  v11 = a3;
  if( a5 )
  {
    v14 = RtlWalkFrameChain((VOID **)(*(_QWORD *)a4 + 16i64), (unsigned int)a3, 0x300ui64);
    if( v14 > 3 )
      v6 = v14 - 3;
    else
      v6 = 0i64;
  }
  if( (*(_DWORD *)(a1 + 116) & 0x400) == 0 && (*(_DWORD *)(a1 + 1296) & 1) == 0 )
  {
    CurrentIrql = ObGetCurrentIrql();
    if( CurrentIrql == 2 )
    {
      if( !*((_BYTE *)KeGetCurrentPrcb() + 32) )
LABEL_15:
        v9 = _InterlockedIncrement64(&EtwpStackMatchId);
    }
    else if( CurrentIrql < 2u )
    {
      if( *(_BYTE *)(a1 + 1310) )
        goto LABEL_15;
      if( *((_BYTE *)KeGetCurrentThread() + 586) == 1 )
        goto LABEL_15;
      v16 = a2 & 1;
      if( v16 )
      {
        if( *((_DWORD *)KeGetCurrentThread() + 121) )
          goto LABEL_15;
      }
      if( !v16 )
      {
        v8 = RtlWalkFrameChain((VOID **)(v7 + 8 * v6), (unsigned int)(v11 - v6), 1ui64);
        if( a6 )
          v9 = *a6;
      }
    }
  }
  v17 = v8 + v6;
  if( v17 || v9 )
  {
    v18 = 8 * (v17 + 1);
    *(_QWORD *)(*(_QWORD *)a4 + 8i64) = v9;
    **(_WORD **)a4 = v18 + 8;
    *(_WORD *)(*(_QWORD *)a4 + 2i64) = 6;
    *(_WORD *)(*(_QWORD *)a4 + 6i64) = v18;
    *(_WORD *)(*(_QWORD *)a4 + 4i64) &= ~1u;
    *(_WORD *)(*(_QWORD *)a4 + 4i64) &= 1u;
  }
  else
  {
    if( v11 == 256 )
      RtlpInterlockedPushEntrySList((PSLIST_HEADER)&EtwpStackLookAsideList, (PSLIST_ENTRY)(*(_QWORD *)a4 - 16i64));
    *(_QWORD *)a4 = 0i64;
  }
}

Referenced by: