EtwpCovSampSafeForUserAddressCapture

NTSTATUS __stdcall EtwpCovSampSafeForUserAddressCapture(INT64 a1, BOOL *a2){
  int v2; 
  unsigned __int8 CurrentIrql; 
  _ETHREAD *CurrentThread; 
  _BOOL4 v5; 
  int v6; 

  v2 = a1;
  CurrentIrql = KeGetCurrentIrql();
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v5 = (CurrentThread->CrossThreadFlags & 1) != 0 || !CurrentThread->Tcb.Teb;
  *(_DWORD *)a2 = v5;
  if( CurrentIrql >= 2u )
    return -1073741637;
  if( KeGetCurrentThread()->WaitBlock[3].SpareLong )
    return -1073741637;
  MmCanThreadFault();
  if( !v6 || CurrentThread->ActiveFaultCount && !v2 )
    return -1073741637;
  if( KeGetCurrentThread()->ApcStateIndex == 1 )
    return -1073741637;
  else
    return 0;
}

Referenced by: