EtwTelemetryCoverageReport

NTSTATUS __stdcall EtwTelemetryCoverageReport(INT64 a1){
  int v1; 
  int v2; 
  VOID **v4; 
  _BOOL4 v5; 
  __int64 v6; 
  __int64 v7; 
  int v8; 
  unsigned int v10; 
  unsigned __int8 v11; 
  INT64 v12; 
  unsigned __int64 v13; 
  int v14; 
  VOID **PoolWithTag; 
  unsigned __int64 v16; 
  __int64 v17; 
  _QWORD *v18; 
  _QWORD *v19; 
  int v20; 
  int v21; 
  int v22; 
  int v23; 
  const CHAR *v24; 
  INT64 v25; 
  int v26; 
  int v27; 
  int v28; 
  int v29; 
  int v30; 
  int v31; 
  int v32; 
  int v33; 
  __int64 v34; 
  _EVENT_DATA_DESCRIPTOR v35; 
  int *v36; 
  int v37; 
  int v38; 
  int *v39; 
  int v40; 
  int v41; 
  int *v42; 
  int v43; 
  int v44; 
  int *v45; 
  int v46; 
  int v47; 
  int *v48; 
  int v49; 
  int v50; 
  int *v51; 
  int v52; 
  int v53; 
  __int64 v54[2]; 

  v1 = 0;
  v2 = 0;
  v25 = 0i64;
  v27 = 0;
  v4 = 0i64;
  v5 = ObGetCurrentIrql() < 2u && (*(_DWORD *)(a1 + 16) & 1) == 0;
  if( !EtwpCoverageNonPagedContext )
  {
    if( !v5 )
      return -1073741641;
    v8 = EtwpCoverageEnsureContext();
    if( v8 < 0 )
      return v8;
  }
  v6 = EtwpCoverageNonPagedContext;
  v7 = EtwpCoverageNonPagedContext + 24;
  if( *(_DWORD *)(a1 + 12) >= 0xFFFFFF00 )
    return -1073741637;
  if( v5 )
  {
    EtwpCoverageRecord((INT64 **)EtwpCoverageContext, a1);
    return 0;
  }
  v26 = 1;
  if( !(unsigned int)EtwpCoverageValidateCP((_BYTE **)a1, &v25) )
  {
    v8 = -1073741811;
LABEL_39:
    if( *(&stru_140CF2E80 + 1828)
      && *(&stru_140C00F40 + 1834) > 5u
      && tlgKeywordOn((__int64)&stru_140C00F40 + 7336, 1i64) )
    {
      v21 = *(_DWORD *)v6;
      v38 = 0;
      v41 = 0;
      v44 = 0;
      v47 = 0;
      v50 = 0;
      v53 = 0;
      v28 = v21;
      v36 = &v28;
      v29 = *(_DWORD *)(v6 + 4);
      v39 = &v29;
      v22 = v20 - *(_DWORD *)(v6 + 16);
      v23 = v20 - *(_DWORD *)(v6 + 20);
      v30 = v22;
      v42 = &v30;
      v45 = &v31;
      v48 = &v32;
      v37 = 4;
      v40 = 4;
      v43 = 4;
      v46 = 4;
      v49 = 4;
      v52 = 4;
      v24 = *(const CHAR **)a1;
      v51 = &v33;
      v31 = v23;
      v32 = v2;
      v33 = v1;
      tlgCreate1Sz_char((INT64)v54, v24);
      tlgWriteTransfer_EtwWriteTransfer(
        (__int64)&stru_140C00F40 + 7336,
        (unsigned __int8 *)byte_14002B629,
        0i64,
        0i64,
        9u,
        &v35);
    }
    return v8;
  }
  v10 = *(_DWORD *)(a1 + 12);
  if( v10 >= *(_DWORD *)v6 )
  {
    v8 = 0;
    v2 = 1;
    v1 = 1;
    goto LABEL_39;
  }
  *(_DWORD *)(a1 + 12) = *(_DWORD *)v6;
  while( 1 )
  {
    v11 = KeAcquireSpinLockRaiseToDpc((UINT64 *)v7);
    v12 = *(_QWORD *)(v7 + 8);
    v13 = v11;
    v34 = *(_QWORD *)(v7 + 64);
    if( v12 )
    {
      HIDWORD(v25) = EtwpCoverageAddToStringBuffer(v12, *(const CHAR **)a1, (unsigned int)v25);
      if( HIDWORD(v25) == 1 )
        break;
    }
    KxReleaseSpinLock((UINT64 *)v7);
    __writecr8(v13);
    if( !v4 )
    {
      PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x400ui64, 1450669125i64);
      v4 = PoolWithTag;
      if( !PoolWithTag )
      {
        *(_DWORD *)(a1 + 12) = v10;
        _InterlockedIncrement((volatile signed __int32 *)(v6 + 4));
        v14 = v26;
        v8 = -1073741670;
        goto LABEL_35;
      }
      memset(PoolWithTag, 0i64, 0x400u);
      v4[2] = v4 + 128;
      v4[3] = v4 + 5;
      v4[4] = v4 + 5;
    }
    v16 = (unsigned __int8)KeAcquireSpinLockRaiseToDpc((UINT64 *)v7);
    v17 = *(_QWORD *)(v7 + 64);
    if( v34 == v17 )
    {
      v18 = *(_QWORD **)(v7 + 8);
      if( v18 )
      {
        v19 = *(_QWORD **)(v7 + 24);
        if( *v19 != v7 + 16 )
          __fastfail(3u);
        *v18 = v7 + 16;
        v18[1] = v19;
        *v19 = v18;
        *(_QWORD *)(v7 + 24) = v18;
        v17 = *(_QWORD *)(v7 + 64);
      }
      *(_QWORD *)(v7 + 8) = v4;
      *(_QWORD *)(v7 + 64) = v17 + 1;
      v4 = 0i64;
    }
    KxReleaseSpinLock((UINT64 *)v7);
    __writecr8(v16);
  }
  if( !*(_DWORD *)(v7 + 72) )
  {
    ExQueueWorkItem((PWORK_QUEUE_ITEM)(v7 + 32), DelayedWorkQueue);
    *(_DWORD *)(v7 + 72) = 1;
  }
  KxReleaseSpinLock((UINT64 *)v7);
  __writecr8(v13);
  v14 = 0;
  v8 = 0;
LABEL_35:
  if( v4 )
    ExFreePoolWithTag(v4, 0x56777445u);
  if( v14 )
  {
    v2 = HIDWORD(v25);
    v1 = v27;
    goto LABEL_39;
  }
  return v8;
}

Referenced by: