EtwpStackRundown

VOID __fastcall EtwpStackRundown(INT64 **a1, UINT64 a2, UINT64 a3){
  __int64 v3; 
  unsigned int v4; 
  INT64 **v7; 
  __int64 v8; 
  unsigned __int8 CurrentIrql; 
  INT64 *i; 
  INT64 *v11; 
  INT64 v12; 
  __int128 v13[2]; 
  v3 = 0i64;
  v4 = a3;
  memset(v13, 0, sizeof(v13));
  if( *((_DWORD *)a1 + 2) )
  {
    do
    {
      v7 = &(&a1[2 * v3 + 4])[v3];
      if( *v7 != (INT64 *)v7 )
      {
        v8 = 0i64;
        CurrentIrql = KeGetCurrentIrql();
        __writecr8(2ui64);
        KxAcquireSpinLock((UINT64 *)v7 + 2);
        for( i = *v7; i != (INT64 *)v7; i = (INT64 *)*i )
        {
          _InterlockedIncrement((volatile signed __int32 *)i + 6);
          *((_QWORD *)v13 + v8) = i;
          v8 = (unsigned int)(v8 + 1);
        }
        KxReleaseSpinLock((UINT64 *)v7 + 2);
        __writecr8(CurrentIrql);
        if( (_DWORD)v8 )
        {
          v11 = (INT64 *)v13;
          do
          {
            v12 = *v11;
            EtwpTraceCachedStack(a2, v4, 0x1824ui64, *v11);
            EtwpDereferenceStackEntry(v12, a1);
            ++v11;
            --v8;
          }
          while( v8 );
        }
      }
      v3 = (unsigned int)(v3 + 1);
    }
    while( (unsigned int)v3 < *((_DWORD *)a1 + 2) );
  }
}

Referenced by: