EtwpCovSampCaptureSample

INT8 __stdcall EtwpCovSampCaptureSample(VOID *SystemArgument1, UINT64 a2){
  _ETHREAD *CurrentThread; 
  INT64 v4; 
  INT64 v5; 
  unsigned int v6; 
  INT64 v7; 
  unsigned int v8; 
  unsigned int v9; 
  __int64 v10; 
  INT64 v11; 
  int v13; 
  unsigned int v14; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v4 = 0i64;
  v5 = *(&ExBootDevicesRemovedEvent + 153);
  v6 = a2;
  v13 = 0;
  v7 = (*(_QWORD *)(*(&ExBootDevicesRemovedEvent + 153) + 8i64) >> 4) & 0x1FFi64;
  v8 = ((unsigned int)*(_QWORD *)(*(&ExBootDevicesRemovedEvent + 153) + 8i64) >> 13) & 0x3FFFF;
  _BitScanReverse(&v9, v8);
  v14 = v9;
  v10 = *(_QWORD *)(*((_QWORD *)KeGetCurrentPrcb()->ExSaPageArray + v9 - 2) + 8i64 * ((1 << v9) ^ v8) + 8);
  if( *(_DWORD *)(v10 + 8 * v7 + 60) )
  {
    _InterlockedIncrement((volatile signed __int32 *)(v10 + 8 * v7 + 304));
  }
  else
  {
    LOBYTE(v7) = (_BYTE)SystemArgument1 - 1;
    if( (char *)SystemArgument1 - 1 > (char *)0xFFFF7FFFFFFFFFFEi64 )
    {
      v7 = (INT64)EtwpCovSampCaptureBufferGet(*(&ExBootDevicesRemovedEvent + 153));
      v4 = v7;
      if( v7 )
      {
        EtwpCovSampCaptureBufferAddIP(v7, (UINT64)SystemArgument1);
        if( !*(_DWORD *)(v5 + 924) )
          EtwpCovSampCaptureKernelStack(v11, v6);
        LOBYTE(v7) = EtwpCovSampCaptureBufferQueue(v5, v4);
        v4 = 0i64;
      }
      SystemArgument1 = 0i64;
    }
    if( (CurrentThread->Tcb._bf_0 & 0x400) == 0 )
    {
      LODWORD(v7) = CurrentThread->CrossThreadFlags;
      if( (v7 & 1) == 0 && (CurrentThread->Tcb._bf_0 & 0x4000) != 0 )
      {
        if( CurrentThread->Tcb.Teb )
        {
          LODWORD(v7) = CurrentThread->Tcb.Process->Pcb.FreezeCount
                      + (((unsigned __int32)CurrentThread->Tcb.Process->Pcb._bf_0 >> 3) & 1);
          if( !(_DWORD)v7 && !CurrentThread->Tcb.SuspendCount )
          {
            LODWORD(v7) = EtwpCovSampSafeForUserAddressCapture(0i64, (BOOL *)&v13);
            if( (int)v7 >= 0 )
            {
              if( !_interlockedbittestandset((volatile signed __int32 *)&CurrentThread->1296, 0x17u) )
              {
                LOBYTE(v7) = EtwpCovSampCaptureUserAddresses((INT64 *)v5, (UINT64)SystemArgument1);
                _InterlockedAnd((volatile signed __int32 *)&CurrentThread->1296, 0xFF7FFFFF);
              }
            }
            else if( !v13 )
            {
              LOBYTE(v7) = EtwpCovSampCaptureQueueApc(SystemArgument1);
            }
          }
        }
      }
    }
    if( v4 )
      LOBYTE(v7) = EtwpCovSampCaptureBufferRelease(v5, v4);
  }
  return v7;
}

Referenced by: