EtwpCovSampCaptureKernelStack

NTSTATUS __stdcall EtwpCovSampCaptureKernelStack(INT64 a1, UINT64 a2){
  NTSTATUS v2; 
  unsigned int v3; 
  int v5; 
  __int64 v6; 
  char v7; 
  int v8; 
  unsigned int v9; 
  unsigned int v10; 
  int v11; 
  unsigned int v12; 
  __int64 v14[5]; 
  unsigned int v15; 
  UINT64 v16; 

  v2 = 0;
  v3 = a2;
  v16 = 0i64;
  v14[0] = 0i64;
  v15 = 0;
  if( !KeQueryCurrentStackInformation((_KERNEL_STACK_LIMITS *)&v15, (UINT64 *)v14, &v16) )
    return -1073741637;
  if( v15 <= 9 )
  {
    v5 = 929;
    if( _bittest(&v5, v15) )
      return -1073741637;
  }
  v6 = *(unsigned __int16 *)(a1 + 62);
  v7 = v3;
  v8 = *(unsigned __int16 *)(a1 + 60);
  v9 = 0;
  v10 = v3 >> 28;
  v11 = v7 & 2;
  if( !v11 )
    v9 = v10;
  if( (unsigned __int16)v8 < (unsigned __int16)v6 )
    return -1073741595;
  v12 = RtlWalkFrameChain(a1 + 64 + 8 * v6, v9 + v8 - (_DWORD)v6, (v9 << 8) | (v11 != 0 ? 2 : 0));
  if( v12 <= v9 )
    return -1073741275;
  *(_DWORD *)(a1 + 56) |= 1u;
  *(_WORD *)(a1 + 62) += v12 - v9;
  EtwpCovSampCaptureBufferOptimizeIP(a1);
  return v2;
}

Referenced by: