EtwQueryProcessTelemetryCoverage

UINT8 __stdcall EtwQueryProcessTelemetryCoverage(ERESOURCE *Resource, UINT8 Wait){
  unsigned int v2; 
  unsigned int *v3; 
  unsigned int *v4; 
  unsigned int v5; 
  UINT8 *v6; 
  _ETHREAD *CurrentThread; 
  INT64 v8; 
  unsigned int v9; 
  __int64 *v10; 
  __int64 *i; 
  __int64 v12; 
  unsigned int v13; 
  __int64 v14; 
  __int64 *j; 
  unsigned int v16; 
  __int64 v17; 
  UINT8 v19; 
  v4 = v3;
  v5 = v2;
  v6 = (UINT8 *)Wait;
  if( Resource == *((ERESOURCE **)KeGetCurrentThread() + 23) )
  {
    if( EtwpCoverageContext )
    {
      if( EtwpCoverageUserIsAdmin() )
      {
        CurrentThread = (_ETHREAD *)KeGetCurrentThread();
        --*((_WORD *)CurrentThread + 242);
        ExAcquirePushLockExclusiveEx((UINT64)&EtwpCoverageLock, 0i64);
        EtwpCoverageLockOwner = (__int64)KeGetCurrentThread();
        v8 = EtwpCoverageContext;
        v9 = *(_DWORD *)(*(_QWORD *)(EtwpCoverageContext + 16) + 16i64);
        v10 = (__int64 *)(EtwpCoverageContext + 48);
        for( i = *(__int64 **)(EtwpCoverageContext + 48); i != v10; i = (__int64 *)*i )
          v9 = *((_DWORD *)i + 6) - (_DWORD)i + v9 - 40;
        if( v4 )
          *v4 = v9;
        v12 = *(_QWORD *)(v8 + 16);
        v13 = *(_DWORD *)(v12 + 16);
        if( v5 < v13 )
          v13 = v5;
        if( v13 )
        {
          v14 = v13;
          memmove(v6, (UINT8 *)v12, v13);
          v6 += v14;
        }
        if( v5 < v9 )
        {
          v19 = 5;
        }
        else
        {
          for( j = (__int64 *)*v10; j != v10; j = (__int64 *)*j )
          {
            v16 = *((_DWORD *)j + 6) - (_DWORD)j - 40;
            if( *((_DWORD *)j + 6) - (_DWORD)j != 40 )
            {
              v17 = v16;
              memmove(v6, (UINT8 *)j + 40, v16);
              v6 += v17;
            }
          }
          v19 = 0;
        }
      }
      else
      {
        v19 = 34;
      }
    }
    else
    {
      v19 = -73;
    }
  }
  else
  {
    v19 = -69;
  }
  if( (struct _KTHREAD *)EtwpCoverageLockOwner == KeGetCurrentThread() )
  {
    EtwpCoverageLockOwner = 0i64;
    if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&EtwpCoverageLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((volatile INT64 *)&EtwpCoverageLock);
    KeAbPostRelease(&EtwpCoverageLock);
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  }
  return v19;
}

Referenced by: