EtwpTraceStackWalk

VOID __stdcall EtwpTraceStackWalk(UINT64 LoggerId, UINT64 Flags, _ETHREAD *Thread, _LARGE_INTEGER *RelatedTimeStamp){
  unsigned int v4; 
  int v6; 
  int v7; 
  _KPROFILE_SOURCE v8; 
  UINT64 v9; 
  char *StackLookasideListEntry; 
  __int64 v11; 
  void *v12; 
  unsigned int v13; 
  unsigned int v14; 
  unsigned int v15; 
  UINT64 v16; 
  unsigned int v17; 
  unsigned int v18; 
  VOID **v19; 
  unsigned int v20; 
  unsigned int v21; 
  unsigned int v22; 
  unsigned int v23; 
  bool v24; 
  unsigned int v25; 
  _ETW_SILODRIVERSTATE *v26; 
  char v27; 
  _KERNEL_STACK_LIMITS Type; 
  UINT64 LowLimit; 
  UINT64 HighLimit; 
  _ETHREAD *v31; 
  _LARGE_INTEGER *v32; 
  __int128 v33; 
  __int64 v34; 
  __int64 v35[3]; 
  unsigned int v36; 
  int v37; 

  v31 = Thread;
  v4 = Flags;
  Type = BugcheckStackLimits;
  LowLimit = 0i64;
  HighLimit = 0i64;
  v32 = RelatedTimeStamp;
  v34 = 0i64;
  v33 = 0i64;
  if( !KeQueryCurrentStackInformation(&Type, &LowLimit, &HighLimit) )
    return;
  if( (unsigned int)Type <= MachineCheckStackLimits )
  {
    v6 = 929;
    if( _bittest(&v6, Type) )
      return;
  }
  v7 = 256;
  StackLookasideListEntry = (char *)EtwpGetStackLookasideListEntry();
  if( !StackLookasideListEntry )
  {
    LODWORD(v11) = KeGetCurrentStackPointer(v9, v8);
    if( v11 - LowLimit <= 0x1438 )
      return;
    v12 = alloca(1536i64);
    StackLookasideListEntry = &v27;
    v7 = 192;
  }
  v13 = 0;
  v14 = 0;
  if( (*(_DWORD *)(LoggerId + 832) & 0x40000000) == 0 )
    goto LABEL_10;
  if( (v4 & 0x800) != 0 )
  {
    v13 = 1;
    *(_QWORD *)StackLookasideListEntry = PsNtosImageBase;
    v4 &= ~0x800u;
LABEL_10:
    if( (v4 & 0x800) != 0 )
    {
      v15 = (v4 >> 20) & 0xF;
      v16 = (v15 << 8) | 2;
      if( (v4 & 0x2000000) == 0 )
        v16 = ((v4 >> 20) & 0xF) << 8;
      v17 = RtlWalkFrameChain((INT64)StackLookasideListEntry, v15 + v7, v16);
      if( v17 > v15 )
        v13 = v17 - v15;
      else
        v13 = 0;
    }
  }
  if( (v4 & 0x1000) != 0 )
  {
    v18 = v7 - v13;
    v19 = (VOID **)&StackLookasideListEntry[8 * v13];
    if( KeGetCurrentThread()->ApcState.Process->PicoContext )
    {
      v14 = PsPicoWalkUserStack(v19, v18);
    }
    else
    {
      v20 = HIWORD(v4) & 0xF;
      v21 = RtlWalkFrameChain((INT64)v19, v18 + v20, (v20 << 8) | 1);
      if( v21 > v20 )
        v14 = v21 - v20;
      else
        v14 = 0;
    }
  }
  v22 = v13 + v14;
  if( v22 )
  {
    v23 = v4 & 0xFFFFE600 | 2;
    v35[1] = 16i64;
    v24 = (*(_DWORD *)(LoggerId + 832) & 0x1000000) == 0;
    DWORD2(v33) = v31->Cid.UniqueProcess;
    HIDWORD(v33) = v31->Cid.UniqueThread;
    *(_LARGE_INTEGER *)&v33 = *v32;
    v35[0] = (__int64)&v33;
    if( v24
      || v22 < 4
      || !EtwpTraceStackKey(
            (unsigned int *)LoggerId,
            v23,
            6182 - (v13 != 0),
            (__int64)v35,
            (__int64)StackLookasideListEntry,
            v22) )
    {
      v25 = *(_DWORD *)LoggerId;
      v26 = *(_ETW_SILODRIVERSTATE **)(LoggerId + 1080);
      v36 = 8 * v22;
      v35[2] = (__int64)StackLookasideListEntry;
      v37 = 0;
      EtwpLogKernelEvent((__int64)v35, v26, v25, 2u, 0x1820u, v23);
    }
  }
  if( v7 == 256 )
    RtlpInterlockedPushEntrySList(&xmmword_140C53A90, (PSLIST_ENTRY)StackLookasideListEntry - 1);
}

Referenced by: