EtwpCoverageRecordAtHighIrql
INT64 __fastcall EtwpCoverageRecordAtHighIrql(INT64 a1){
INT64 result;
__int64 v3;
unsigned __int8 CurrentIrql;
INT64 v5[2];
__int64 v6;
char pszDest[64];
result = EtwpCoverageValidateCP((INT64 *)a1);
if( (_DWORD)result )
{
v3 = *(_QWORD *)(a1 + 16);
*(_OWORD *)v5 = *(_OWORD *)a1;
v6 = v3;
RtlStringCchCopyA(pszDest, 0x40ui64, (PSTR)v5[0]);
HIDWORD(v5[1]) = 0;
v5[0] = (INT64)pszDest;
CurrentIrql = KeGetCurrentIrql();
__writecr8(2ui64);
EtwTelemetryCoverageReport((INT64)v5);
__writecr8(CurrentIrql);
result = HIDWORD(v5[1]);
*(_DWORD *)(a1 + 12) = HIDWORD(v5[1]);
}
return result;
}Referenced by:
EtwSetProcessTelemetryCoverage