EtwpCovSampContextAddSamples

NTSTATUS __stdcall EtwpCovSampContextAddSamples(PVOID BugCheckParameter2){
  __int64 v1; 
  unsigned int v2; 
  unsigned int v3; 
  __int64 v4; 
  unsigned int v7; 
  unsigned int v8; 
  __int64 v9; 
  unsigned int RoomAndAcquireLock; 
  __int64 v11; 
  _DWORD *v12; 
  __int64 v13; 
  NTSTATUS v14; 
  int v15; 
  int v16; 
  unsigned int i; 
  _QWORD *v18; 
  int v19; 
  _QWORD *v21; 
  _QWORD *v22; 
  INT64 v23; 
  __int64 v25; 
  unsigned int v26; 

  v25 = v1;
  v3 = v2;
  v4 = v1;
  v7 = 0;
  v8 = 0;
  v9 = *(&ExBootDevicesRemovedEvent + 153);
  RoomAndAcquireLock = EtwpCovSampHashMakeRoomAndAcquireLock(BugCheckParameter2);
  v26 = RoomAndAcquireLock;
  if( RoomAndAcquireLock < v3 )
  {
    EtwpCovSampCaptureContextSetPaused((__int64)BugCheckParameter2, v9, 1);
    RoomAndAcquireLock = v26;
  }
  v11 = 0i64;
  while( RoomAndAcquireLock && (unsigned int)v11 < v3 )
  {
    v12 = (_DWORD *)(v4 + 8 * v11);
    v22 = v12;
    v13 = *((_QWORD *)BugCheckParameter2 + 149);
    if( !v13 )
      goto LABEL_13;
    LODWORD(v23) = *((_DWORD *)BugCheckParameter2 + 7);
    HIDWORD(v23) = v23;
    v14 = EtwCovSampHash(__PAIR64__(*v12, v12[1]), v23);
    v16 = 1;
    for( i = 0; i < *((_DWORD *)BugCheckParameter2 + 302); ++i )
    {
      if( (*(_BYTE *)(((*((_DWORD *)BugCheckParameter2 + 301) & (v14 + i * v15)) >> 3) + v13) & (unsigned __int8)(1 << (*((_BYTE *)BugCheckParameter2 + 1204) & (v14 + i * v15) & 7))) == 0 )
      {
        v16 = 0;
        break;
      }
    }
    if( !v16 )
    {
LABEL_13:
      v18 = (_QWORD *)*((_QWORD *)BugCheckParameter2 + 146);
      while( 1 )
      {
        v21 = v18;
        EtwpCovSampHashLookupInTable();
        if( v19 )
          break;
        v18 = (_QWORD *)*v18;
        if( v18 == (_QWORD *)((char *)BugCheckParameter2 + 1168) )
        {
          MEMORY[0] = *v22;
          ++*((_DWORD *)v21 + 4);
          ++v7;
          RoomAndAcquireLock = --v26;
          goto LABEL_18;
        }
      }
    }
    ++v8;
    RoomAndAcquireLock = v26;
LABEL_18:
    v11 = (unsigned int)(v11 + 1);
    v4 = v25;
  }
  if( *((struct _KTHREAD **)BugCheckParameter2 + 1) == KeGetCurrentThread() )
  {
    *((_QWORD *)BugCheckParameter2 + 1) = 0i64;
    if( (_InterlockedExchangeAdd64((volatile signed __int64 *)BugCheckParameter2, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((_EX_PUSH_LOCK *)BugCheckParameter2);
    KeAbPostRelease(BugCheckParameter2);
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
  }
  _InterlockedExchangeAdd((volatile signed __int32 *)BugCheckParameter2 + 154, v7);
  _InterlockedExchangeAdd((volatile signed __int32 *)BugCheckParameter2 + 155, v8);
  if( v3 > v8 + v7 )
    _InterlockedExchangeAdd((volatile signed __int32 *)BugCheckParameter2 + 156, v3 - v8 - v7);
  return v7;
}

Referenced by: