EtwpCovSampSampleBufferProcess

void __fastcall EtwpCovSampSampleBufferProcess(INT64 *a1, _DWORD *a2){
  int v4; 
  _DWORD *v5; 
  int v6; 
  PVOID v7; 
  int v8; 
  INT64 v9; 
  int v10; 
  PVOID BugCheckParameter2; 

  BugCheckParameter2 = 0i64;
  if( (int)EtwpCovSampAcquireSamplerRundown((_LIST_ENTRY **)&BugCheckParameter2) < 0
    || (v4 = 0, v5 = a2 + 18, v6 = 0, (int)a2[14] <= 0) )
  {
    v7 = BugCheckParameter2;
  }
  else
  {
    v7 = BugCheckParameter2;
    do
    {
      if( v4 + 16 > a2[16] )
        break;
      v8 = v5[1];
      v9 = HIWORD(v8) & 0x7FFF;
      if( *v5 != v4
        || (unsigned __int16)v8 < (unsigned int)(8 * v9)
        || (unsigned int)(unsigned __int16)v8 + *v5 > a2[15] )
      {
        break;
      }
      if( v8 >= 0 )
      {
        if( !EtwpCovSampStackHashCheck(a1, (unsigned __int16)v8, (UINT8 *)v5 + 8, v9) )
        {
          v7 = BugCheckParameter2;
          EtwpCovSampContextAddAddresses(
            BugCheckParameter2,
            (__int64)KeGetCurrentThread()->ApcState.Process,
            (_QWORD *)v5 + 1,
            *((_WORD *)v5 + 3) & 0x7FFF);
        }
      }
      else
      {
        EtwpCovSampContextAddSamples(v7);
      }
      v10 = v5[1];
      ++v6;
      v4 += (unsigned __int16)v10;
      v5 = (_DWORD *)((char *)v5 + (unsigned __int16)v10);
    }
    while( v6 < a2[14] );
  }
  if( v7 )
  {
    ExReleaseRundownProtection((_EX_RUNDOWN_REF *)&ExBootDevicesRemovedEvent + 152);
    KeLeaveCriticalRegion();
  }
}

Referenced by: