EtwpCovSampLookasideGrow

NTSTATUS __fastcall EtwpCovSampLookasideGrow(INT64 a1, INT64 a2){
  __int64 v2; 
  NTSTATUS v5; 
  _SLIST_ENTRY *v6; 
  UINT64 *v7; 
  unsigned __int64 v8; 
  unsigned int v9; 
  _SLIST_ENTRY *v10; 
  __int64 v11; 
  _SLIST_ENTRY *v12; 

  v2 = *(_QWORD *)(a2 + 32);
  KeGetCurrentIrql();
  if( *(_DWORD *)(a2 + 52) >= *(_DWORD *)(a2 + 56) )
    return 255;
  v6 = (_SLIST_ENTRY *)(*(__int64(**)(void))(v2 + 48))();
  if( !v6 )
    return -1073741670;
  v7 = (UINT64 *)(a1 + 264);
  v8 = (unsigned __int8)KeAcquireSpinLockRaiseToDpc((UINT64 *)(a1 + 264));
  if( *(_DWORD *)(a2 + 40) && (v9 = *(_DWORD *)(a2 + 52), v9 < *(_DWORD *)(a2 + 56)) )
  {
    *(_DWORD *)(a2 + 52) = v9 + 1;
    v10 = (_SLIST_ENTRY *)((char *)v6 + 24);
    ++*(_DWORD *)(v2 + 72);
    v11 = v2 + 32;
    v12 = *(_SLIST_ENTRY **)(v11 + 8);
    if( v12->Next != (_SLIST_ENTRY *)v11 )
      __fastfail(3u);
    v6[2].Next = v12;
    v10->Next = (_SLIST_ENTRY *)v11;
    v12->Next = v10;
    *(_QWORD *)(v11 + 8) = v10;
    RtlpInterlockedPushEntrySList((PSLIST_HEADER)a2, v6);
    v6 = 0i64;
    v5 = 0;
  }
  else
  {
    v5 = 255;
  }
  KxReleaseSpinLock(v7);
  __writecr8(v8);
  if( v6 )
    ExFreePoolWithTag(v6, 0x56777445u);
  return v5;
}

Referenced by: