EtwpCoverageRecord

VOID __fastcall EtwpCoverageRecord(INT64 **a1, INT64 a2){
  int v4; 
  int v5; 
  unsigned __int64 v6; 
  _ETHREAD *CurrentThread; 
  unsigned int v8; 
  unsigned int v9; 
  INT64 v10; 
  INT64 *v11; 
  UINT64 *Internal; 
  int v13; 
  INT64 v14; 
  _KTIMER2 *v15; 
  char v16; 
  WCHAR **v17; 
  VOID *v18; 
  UINT8 v19; 
  int v20; 
  INT64 *v21; 
  const CHAR *v22; 
  INT64 *v23; 
  const CHAR *v24; 
  int v25; 
  CHAR v26; 
  INT64 v27; 
  INT64 a7; 
  unsigned int a7a; 
  INT64 a8; 
  INT64 a9; 
  int v32; 
  int v33; 
  int v34; 
  int v35; 
  int v36; 
  int v37; 
  int v38; 
  int v39; 
  int v40; 
  _EXT_SET_PARAMETERS_V0 Parameters; 
  struct _EVENT_DATA_DESCRIPTOR v42; 
  int *v43; 
  __int64 v44; 
  int *v45; 
  __int64 v46; 
  int *v47; 
  __int64 v48; 
  int *v49; 
  __int64 v50; 
  int *v51; 
  __int64 v52; 
  int *v53; 
  __int64 v54; 
  char v55[16]; 
  struct _EVENT_DATA_DESCRIPTOR v56; 
  __int64 v57; 
  __int64 v58; 
  int *v59; 
  __int64 v60; 
  int *v61; 
  __int64 v62; 
  int *v63; 
  __int64 v64; 
  char v65[16]; 
  LODWORD(a9) = 0;
  v4 = 0;
  v5 = 0;
  LODWORD(a7) = 0;
  v6 = (KUSER_SHARED_DATA.TickCountQuad * KUSER_SHARED_DATA.TickCountMultiplier) >> 24;
  a8 = v6;
  if( (unsigned int)EtwpCoverageValidateCP((INT64 *)a2) )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 242);
    ExAcquirePushLockExclusiveEx((UINT64)&EtwpCoverageLock, 0i64);
    v8 = *(_DWORD *)(a2 + 12);
    EtwpCoverageLockOwner = (__int64)KeGetCurrentThread();
    v9 = *((_DWORD *)a1[2] + 6);
    if( v8 >= v9 )
    {
      v4 = 1;
    }
    else
    {
      v10 = *(unsigned int *)(a2 + 8);
      *(_DWORD *)(a2 + 12) = v9;
      v11 = a1[2];
      Internal = TelemetryCoverageTableLocateInternal((UINT64 *)v11, v10);
      if( *(_DWORD *)Internal == v13 )
      {
        v5 = a9;
        v4 = 1;
      }
      else if( *((_DWORD *)v11 + 8) >= *((_DWORD *)a1 + 8) )
      {
        _InterlockedIncrement((volatile signed __int32 *)*a1 + 1);
        v5 = 0;
      }
      else
      {
        v5 = EtwpCoverageAddToStringBuffer((INT64)a1[5], *(const CHAR **)a2, 0i64);
        if( v5 )
          goto LABEL_6;
        EtwpCoverageFlushPending((INT64)a1);
        EtwpCoverageEnsureStringBuffer((INT64)a1, v17, v18, v19, v26, v27, a7, a8, a9);
        if( v20 >= 0 )
        {
          v5 = EtwpCoverageAddToStringBuffer((INT64)a1[5], *(const CHAR **)a2, a7a);
LABEL_6:
          *(_DWORD *)Internal = *(_DWORD *)(a2 + 8);
          ++*((_DWORD *)a1 + 16);
          ++*((_DWORD *)a1[2] + 8);
          if( *((_DWORD *)a1 + 16) == 1 )
          {
            v14 = -10000i64 * *((unsigned int *)a1 + 7);
            v15 = (_KTIMER2 *)(*a1 + 30);
            *(_QWORD *)&Parameters.Version = 0i64;
            Parameters.NoWakeTolerance = -1i64;
            KeSetTimer2(v15, v14, 0i64, &Parameters);
          }
          goto LABEL_9;
        }
        *(_DWORD *)(a2 + 12) = v8;
        _InterlockedIncrement((volatile signed __int32 *)*a1 + 1);
      }
    }
LABEL_9:
    LODWORD(v6) = a8;
  }
  if( (struct _KTHREAD *)EtwpCoverageLockOwner == KeGetCurrentThread() )
  {
    EtwpCoverageLockOwner = 0i64;
    v16 = _InterlockedExchangeAdd64((volatile signed __int64 *)&EtwpCoverageLock, 0xFFFFFFFFFFFFFFFFui64);
    if( (v16 & 2) != 0 && (v16 & 4) == 0 )
      ExfTryToWakePushLock((volatile INT64 *)&EtwpCoverageLock);
    KeAbPostRelease(&EtwpCoverageLock);
    KeLeaveCriticalRegion();
  }
  if( !v4 && v5 && (unsigned int)dword_140C02BE8 > 5 && tlgKeywordOn((__int64)&dword_140C02BE8, 2i64) )
  {
    v21 = *a1;
    v22 = *(const CHAR **)a2;
    HIDWORD(a9) = *(_DWORD *)*a1;
    v57 = (__int64)&a9 + 4;
    v58 = 4i64;
    v32 = *((_DWORD *)v21 + 1);
    v59 = &v32;
    v60 = 4i64;
    v33 = v6 - *((_DWORD *)v21 + 4);
    v61 = &v33;
    v62 = 4i64;
    v34 = v6 - *((_DWORD *)v21 + 5);
    v63 = &v34;
    v64 = 4i64;
    tlgCreate1Sz_char((__int64)v65, v22);
    tlgWriteTransfer_EtwWriteTransfer(
      (__int64)&dword_140C02BE8,
      (unsigned __int8 *)byte_14002B711,
      0i64,
      0i64,
      7u,
      &v56);
  }
  if( EtwpCoverageCoreTracingEnabled && (unsigned int)dword_140C02BE8 > 5 )
  {
    if( tlgKeywordOn((__int64)&dword_140C02BE8, 1i64) )
    {
      v23 = *a1;
      v24 = *(const CHAR **)a2;
      v35 = *(_DWORD *)*a1;
      v43 = &v35;
      v44 = 4i64;
      v36 = *((_DWORD *)v23 + 1);
      v45 = &v36;
      v46 = 4i64;
      v37 = v6 - *((_DWORD *)v23 + 4);
      v47 = &v37;
      v48 = 4i64;
      v25 = v6 - *((_DWORD *)v23 + 5);
      v49 = &v38;
      v51 = &v39;
      v53 = &v40;
      v38 = v25;
      v50 = 4i64;
      v39 = v5;
      v52 = 4i64;
      v40 = v4;
      v54 = 4i64;
      tlgCreate1Sz_char((__int64)v55, v24);
      tlgWriteTransfer_EtwWriteTransfer(
        (__int64)&dword_140C02BE8,
        (unsigned __int8 *)byte_14002B69D,
        0i64,
        0i64,
        9u,
        &v42);
    }
  }
}

Referenced by: