EtwpQueueStackWalkApc

VOID __stdcall EtwpQueueStackWalkApc(
        _ETHREAD *Thread,
        UINT8 CurrentIrql,
        UINT64 LoggerId,
        _LARGE_INTEGER *RelatedTimeStamp){
  char v4; 
  _KAPC *v5; 
  unsigned int v10; 
  INT64 HighPart; 
  INT64 LowPart; 
  INT8 inserted; 
  int v14; 

  v4 = 0;
  v5 = 0i64;
  if( Thread != (_ETHREAD *)KeGetCurrentThread() )
    return;
  if( Thread->Tcb.Process->Pcb.FreezeCount + (((unsigned __int32)Thread->Tcb.Process->Pcb._bf_0 >> 3) & 1) )
    return;
  if( Thread->Tcb.SuspendCount )
    return;
  v10 = (*(_WORD *)(LoggerId + 834) & 7) + 24;
  if( _interlockedbittestandset((volatile signed __int32 *)&Thread->Tcb.116 + 1, v10) )
    return;
  if( (Thread->Tcb._bf_0 & 0x4000) == 0 )
    goto LABEL_15;
  if( !ExAcquireRundownProtectionCacheAwareEx(
          *(_QWORD *)(*(_QWORD *)(*(_QWORD *)(LoggerId + 1080) + 448i64) + 8i64 * *(unsigned int *)LoggerId),
          1i64) )
    goto LABEL_15;
  v4 = 1;
  v5 = (_KAPC *)RtlpInterlockedPopEntrySList((PSLIST_HEADER)(LoggerId + 928));
  if( !v5 )
    goto LABEL_15;
  KeInitializeApc(
    (INT64)v5,
    (INT64)Thread,
    0i64,
    (INT64)EtwpStackWalkApc,
    (INT64)EtwpCancelStackWalkApc,
    (INT64)EtwpStackWalkApc,
    0,
    LoggerId);
  if( !*(_DWORD *)(LoggerId + 336) )
    goto LABEL_15;
  HighPart = (unsigned int)RelatedTimeStamp->anonymous_0.HighPart;
  LowPart = RelatedTimeStamp->anonymous_0.LowPart;
  if( CurrentIrql <= 2u )
    inserted = KeInsertQueueApc((INT64)v5, LowPart, HighPart, 0i64);
  else
    KeTryToInsertQueueApc(v5, (VOID *)LowPart, (VOID *)HighPart);
  if( !*(_DWORD *)(LoggerId + 336) )
  {
    if( inserted && !KeRemoveQueueApc((INT64)v5) )
      return;
    goto LABEL_15;
  }
  if( !inserted )
  {
    if( CurrentIrql > 2u )
      EtwpQueueStackWalkDpc(Thread, LoggerId, RelatedTimeStamp);
LABEL_15:
    _interlockedbittestandreset((volatile signed __int32 *)&Thread->Tcb.116 + 1, v10);
    if( v4 )
      ExReleaseRundownProtectionCacheAwareEx(
        *(_QWORD *)(*(_QWORD *)(*(_QWORD *)(LoggerId + 1080) + 448i64) + 8i64 * *(unsigned int *)LoggerId),
        1i64);
    if( v5 )
      RtlpInterlockedPushEntrySList((PSLIST_HEADER)(LoggerId + 928), (PSLIST_ENTRY)v5);
    return;
  }
  _InterlockedIncrement((volatile signed __int32 *)(LoggerId + 960));
  v14 = *(_DWORD *)(LoggerId + 960);
  if( v14 > *(_DWORD *)(LoggerId + 964) )
    *(_DWORD *)(LoggerId + 964) = v14;
}

Referenced by: