EtwpLocateDbgIdForRegEntry

NTSTATUS __stdcall EtwpLocateDbgIdForRegEntry(CHAR a1, INT64 a2, _XSTATE_CONFIGURATION *a3, _XSTATE_CONFIGURATION *a4){
  VOID *v6; 
  _ETHREAD *CurrentThread; 
  NTSTATUS result; 
  UINT64 v9; 
  UINT64 ImageSize; 
  VOID *ImageBase; 
  __int64 v12; 
  int v13; 

  v13 = 0;
  v12 = 0i64;
  ImageBase = 0i64;
  ImageSize = 0i64;
  v6 = *(VOID **)(a2 + 88);
  if( !v6 )
    return -1073741503;
  if( !a1 )
  {
    RtlPcToFileHeader(v6, &ImageBase);
    if( !ImageBase )
      return -1073741275;
LABEL_5:
    result = RtlImageNtHeaderEx(1, (unsigned __int64)ImageBase & 0xFFFFFFFFFFFFFFFCui64, ImageSize, &v12);
    if( result >= 0 )
    {
      v9 = ImageSize;
      if( !ImageSize )
      {
        result = EtwpGetImageSize(v12, &ImageSize);
        v9 = ImageSize;
      }
      if( result >= 0 )
      {
        if( a1 == 1
          && v9
          && ((unsigned __int64)ImageBase + v9 > 0x7FFFFFFF0000i64 || (char *)ImageBase + v9 < ImageBase) )
        {
          MEMORY[0x7FFFFFFF0000] = 0;
          v9 = ImageSize;
        }
        return EtwpFindDebugId(ImageBase, v9, 0i64, &a3->EnabledFeatures);
      }
    }
    return result;
  }
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  if( (*(_BYTE *)&CurrentThread->Tcb.ApcState.Process->Pcb.SecureState & 1) != 0 )
    return VslGetEtwDebugId(
             (INT64)CurrentThread->Tcb.ApcState.Process,
             *(_QWORD *)(a2 + 88),
             (INT64 *)a3,
             &a4->EnabledFeatures);
  result = MmGetImageInformation(v6, &ImageBase, &ImageSize, &v13);
  if( result >= 0 )
    goto LABEL_5;
  return result;
}

Referenced by: