ObSetRefTraceInformation

NTSTATUS __stdcall ObSetRefTraceInformation(VOID *SystemInformation, UINT64 SystemInformationLength){
  __int64 v2; 
  char PreviousMode; 

  v2 = (unsigned int)SystemInformationLength;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, PreviousMode) )
    return -1073741790;
  if( (unsigned int)v2 < 0x28 )
    return -1073741811;
  if( PreviousMode )
  {
    if( ((unsigned __int8)SystemInformation & 7) != 0 )
      ExRaiseDatatypeMisalignment();
    if( (unsigned __int64)SystemInformation + v2 > 0x7FFFFFFF0000i64
      || (char *)SystemInformation + v2 < SystemInformation )
    {
      MEMORY[0x7FFFFFFF0000] = 0;
    }
  }
  if( *(_BYTE *)SystemInformation )
    return ObpStartRuntimeStackTrace((__int64)SystemInformation);
  else
    return ObpStopRuntimeStackTrace();
}

Referenced by: