EtwpCoverageSamplerPageFault

VOID __stdcall EtwpCoverageSamplerPageFault(INT64 SystemArgument1, UINT64 a2, CHAR a3){
  INT64 v3; 
  _ETHREAD *CurrentThread; 
  unsigned __int64 v6; 
  __int64 v7; 
  unsigned int v8; 
  __int64 v9; 
  int v10; 
  unsigned int LowPart; 
  int v12; 
  int v13; 
  int v14; 
  unsigned int v15; 
  unsigned int v16; 
  unsigned int v17; 
  int v18; 
  int v19; 
  if( a3 )
  {
    v3 = StartContext;
    if( (unsigned __int64)(SystemArgument1 - 1) <= 0xFFFF7FFFFFFFFFFEui64 && a2 < 0xFFFF800000000000ui64 )
    {
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --*((_WORD *)CurrentThread + 243);
      v6 = *(_QWORD *)(v3 + 8);
      LODWORD(CurrentThread) = v6;
      v7 = (v6 >> 4) & 0x1FF;
      LODWORD(CurrentThread) = ((unsigned int)CurrentThread >> 13) & 0x3FFFF;
      _BitScanReverse(&v8, (unsigned int)CurrentThread);
      v9 = *(_QWORD *)(*(_QWORD *)(*((_QWORD *)KeGetCurrentPrcb() + 4198) + 8i64 * (v8 - 2))
                     + 8i64 * ((unsigned int)CurrentThread ^ (1 << v8))
                     + 8);
      if( *(_DWORD *)(v9 + 8 * v7 + 264) )
      {
        LowPart = KUSER_SHARED_DATA.TickCount.LowPart;
        if( KUSER_SHARED_DATA.TickCount.LowPart - *(_DWORD *)(v9 + 8 * v7 + 268) > *(_DWORD *)(v9 + 8 * v7 + 272) )
        {
          v12 = *(_DWORD *)(v9 + 8 * v7 + 264);
          *(_DWORD *)(v9 + 8 * v7 + 284) += v12;
          v13 = *(_DWORD *)(v9 + 8 * v7 + 284);
          v14 = *(_DWORD *)(v9 + 8 * v7 + 280);
          if( v13 > *(_DWORD *)(v9 + 8 * v7 + 276) )
            v13 = *(_DWORD *)(v9 + 8 * v7 + 276);
          *(_DWORD *)(v9 + 8 * v7 + 268) = LowPart;
          v15 = *(_DWORD *)(v9 + 8 * v7 + 292) + v14;
          *(_DWORD *)(v9 + 8 * v7 + 280) = 0;
          v16 = v15 >> 1;
          *(_DWORD *)(v9 + 8 * v7 + 284) = v13;
          *(_DWORD *)(v9 + 8 * v7 + 292) = v16;
          if( v16 >= 2 * v12 )
          {
            v17 = v16 / (v12 + 1);
            v18 = LowPart ^ *(_DWORD *)(v9 + 8 * v7 + 300);
            *(_DWORD *)(v9 + 8 * v7 + 296) = v17;
            *(_DWORD *)(v9 + 8 * v7 + 300) = 16777619 * v18;
            *(_DWORD *)(v9 + 8 * v7 + 288) = (16777619 * v18) & (2 * v17);
          }
          else
          {
            *(_DWORD *)(v9 + 8 * v7 + 296) = 1;
            *(_DWORD *)(v9 + 8 * v7 + 288) = 1;
          }
        }
        ++*(_DWORD *)(v9 + 8 * v7 + 280);
        v19 = *(_DWORD *)(v9 + 8 * v7 + 284);
        if( v19 <= 0 || (--*(_DWORD *)(v9 + 8 * v7 + 288), *(int *)(v9 + 8 * v7 + 288) > 0) )
        {
          v10 = 0;
LABEL_16:
          KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
          if( v10 )
          {
            _InterlockedAdd((volatile signed __int32 *)(v9 + 8 * v7 + 332), 1u);
            EtwpCovSampCaptureSample((PVOID)SystemArgument1, 0x50000010ui64);
          }
          return;
        }
        *(_DWORD *)(v9 + 8 * v7 + 284) = v19 - 1;
        *(_DWORD *)(v9 + 8 * v7 + 288) = *(_DWORD *)(v9 + 8 * v7 + 296);
      }
      v10 = 1;
      goto LABEL_16;
    }
  }
}

Referenced by: