EtwpGetStackExtendedHeaderItem

VOID __stdcall EtwpGetStackExtendedHeaderItem(
        _ETHREAD *CurrentThread,
        UINT64 Flags,
        UINT64 FrameCount,
        _ETWP_HEADER_EXTENDED_DATA_ITEM **StackExtendedHeaderItem,
        UINT8 CaptureKernelStack,
        UINT64 *RelatedMatchId){
  __int64 v6; 
  _ETWP_HEADER_EXTENDED_DATA_ITEM *v7; 
  __int16 v8; 
  UINT64 v9; 
  int v11; 
  char v12; 
  unsigned int v14; 
  UINT8 CurrentIrql; 
  int v16; 
  __int16 v17; 
  unsigned __int16 v18; 

  v6 = 0i64;
  v7 = *StackExtendedHeaderItem + 2;
  v8 = 0;
  v9 = 0i64;
  v11 = FrameCount;
  v12 = Flags;
  if( CaptureKernelStack )
  {
    v14 = RtlWalkFrameChain((INT64)&(*StackExtendedHeaderItem)[2], (unsigned int)FrameCount, 0x300ui64);
    if( v14 > 3 )
      v6 = v14 - 3;
    else
      v6 = 0i64;
  }
  if( (CurrentThread->Tcb._bf_0 & 0x400) == 0 && (CurrentThread->CrossThreadFlags & 1) == 0 )
  {
    CurrentIrql = ObGetCurrentIrql();
    if( CurrentIrql == 2 )
    {
      if( !KeGetCurrentPrcb()->NestingLevel )
LABEL_15:
        v9 = _InterlockedIncrement64(&EtwpStackMatchId);
    }
    else if( CurrentIrql < 2u )
    {
      if( CurrentThread->ActiveFaultCount )
        goto LABEL_15;
      if( KeGetCurrentThread()->ApcStateIndex == 1 )
        goto LABEL_15;
      v16 = v12 & 1;
      if( v16 )
      {
        if( KeGetCurrentThread()->WaitBlock[3].SpareLong )
          goto LABEL_15;
      }
      if( !v16 )
      {
        v8 = RtlWalkFrameChain((INT64)&v7[v6], (unsigned int)(v11 - v6), 1ui64);
        if( RelatedMatchId )
          v9 = *RelatedMatchId;
      }
    }
  }
  v17 = v8 + v6;
  if( v17 || v9 )
  {
    v18 = 8 * (v17 + 1);
    (*StackExtendedHeaderItem)[1] = (_ETWP_HEADER_EXTENDED_DATA_ITEM)v9;
    (*StackExtendedHeaderItem)->Size = v18 + 8;
    (*StackExtendedHeaderItem)->ExtType = 6;
    (*StackExtendedHeaderItem)->DataSize = v18;
    (*StackExtendedHeaderItem)->_bf_4 &= ~1u;
    (*StackExtendedHeaderItem)->_bf_4 &= 1u;
  }
  else
  {
    if( v11 == 256 )
      RtlpInterlockedPushEntrySList(&xmmword_140C53A90, (PSLIST_ENTRY)&(*StackExtendedHeaderItem)[-2]);
    *StackExtendedHeaderItem = 0i64;
  }
}

Referenced by: