EtwpCovSampCaptureUserStack

NTSTATUS __stdcall EtwpCovSampCaptureUserStack(INT64 a1){
  NTSTATUS v1; 
  __int64 v3; 
  int v4; 
  NTSTATUS v5; 

  v1 = 0;
  if( KeGetCurrentThread()->ApcState.Process->PicoContext )
    return -1073741637;
  v3 = *(unsigned __int16 *)(a1 + 62);
  v4 = *(unsigned __int16 *)(a1 + 60);
  if( (unsigned __int16)v4 < (unsigned __int16)v3 )
    return -1073741595;
  v5 = RtlWalkFrameChain(a1 + 8 * (v3 + 8), (unsigned int)(v4 - v3), 1ui64);
  if( !v5 )
    return -1073741275;
  *(_WORD *)(a1 + 62) += v5;
  *(_DWORD *)(a1 + 56) |= 2u;
  EtwpCovSampCaptureBufferOptimizeIP(a1);
  return v1;
}

Referenced by: