EtwpCovSampContextPruneModules

UINT64 __stdcall EtwpCovSampContextPruneModules(INT64 a1){
  UINT64 result; 
  __int64 v3; 
  _QWORD *v4; 
  __int64 v5; 
  _ETHREAD *CurrentThread; 
  volatile signed __int64 *v7; 
  __int64 *i; 
  unsigned int v9; 
  __int64 v10; 
  _QWORD *v11; 
  _OWORD *v12; 
  _QWORD *v13; 
  __int128 *v14; 
  _QWORD *v15; 
  __int64 v16; 
  _ETHREAD *v17; 
  __int128 *v18; 
  __int128 *v19; 
  char *v20; 
  bool v21; 
  int v22; 
  char *j; 
  _QWORD *v24; 
  int v25; 
  _QWORD *k; 
  _QWORD *v27; 
  __int64 v28; 
  _QWORD *v29; 
  _OWORD **v30; 
  __int64 v31; 
  void *v32; 
  __int64 v33; 
  __int128 v34; 
  __int128 v35; 
  _OWORD v36[8]; 

  result = *(_DWORD *)(a1 + 16) >> 1;
  v35 = 0i64;
  v34 = 0i64;
  if( *(_DWORD *)(a1 + 732) > (unsigned int)result || *(_DWORD *)(a1 + 1124) > (int)result )
  {
    result = (unsigned int)_InterlockedCompareExchange(
                             (volatile signed __int32 *)(a1 + 1128),
                             (signed __int32)PsGetCurrentThreadId(),
                             0);
    if( !(_DWORD)result )
    {
      v3 = 8i64;
      v4 = v36;
      v5 = 8i64;
      do
      {
        v4[1] = v4;
        *v4 = v4;
        v4 += 2;
        --v5;
      }
      while( v5 );
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --CurrentThread->Tcb.KernelApcDisable;
      v7 = (volatile signed __int64 *)(a1 + 664);
      ExAcquirePushLockSharedEx((_EX_PUSH_LOCK *)(a1 + 664), 0i64);
      for( i = *(__int64 **)(a1 + 712); i != (__int64 *)(a1 + 712); i = (__int64 *)*i )
      {
        if( *(i - 1) == 1 && !*((_DWORD *)i + 15) )
        {
          v9 = KUSER_SHARED_DATA.TickCount.LowPart - *((_DWORD *)i + 16);
          if( v9 >= 0x100 )
            v10 = ((v9 - 256) >> 8) + 4;
          else
            v10 = v9 >> 6;
          if( (unsigned int)v10 >= 8 )
            v10 = 7i64;
          v11 = i + 2;
          v12 = &v36[v10];
          v13 = (_QWORD *)*((_QWORD *)v12 + 1);
          if( (_OWORD *)*v13 != v12 )
LABEL_54:
            __fastfail(3u);
          *v11 = v12;
          i[3] = (__int64)v13;
          *v13 = v11;
          *((_QWORD *)v12 + 1) = v11;
        }
      }
      if( _InterlockedCompareExchange64(v7, 0i64, 17i64) != 17 )
        ExfReleasePushLockShared((_EX_PUSH_LOCK *)(a1 + 664));
      KeAbPostRelease((VOID *)(a1 + 664));
      KeLeaveCriticalRegionThread(KeGetCurrentThread());
      v14 = &v35;
      *((_QWORD *)&v35 + 1) = &v35;
      *(_QWORD *)&v35 = &v35;
      v15 = v36;
      do
      {
        if( (_QWORD *)*v15 != v15 )
        {
          *(_QWORD *)v14 = *v15;
          *(_QWORD *)(*v15 + 8i64) = *((_QWORD *)&v35 + 1);
          *((_QWORD *)&v35 + 1) = v15[1];
          **((_QWORD **)&v35 + 1) = &v35;
          v14 = (__int128 *)*((_QWORD *)&v35 + 1);
        }
        v15 += 2;
        --v3;
      }
      while( v3 );
      v16 = 0i64;
      *((_QWORD *)&v34 + 1) = &v34;
      *(_QWORD *)&v34 = &v34;
      v17 = (_ETHREAD *)KeGetCurrentThread();
      --v17->Tcb.KernelApcDisable;
      ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)(a1 + 664), 0i64);
      v18 = (__int128 *)v35;
      *(_QWORD *)(a1 + 672) = KeGetCurrentThread();
      while( v18 != &v35 )
      {
        v19 = v18;
        v20 = (char *)v18 - 88;
        v21 = *((_QWORD *)v18 - 3) == 1i64;
        v18 = *(__int128 **)v18;
        *((_QWORD *)v19 + 1) = v19;
        *(_QWORD *)v19 = v19;
        if( v21 && !*((_DWORD *)v20 + 33) && ++v16 > (unsigned __int64)*(unsigned int *)(a1 + 16) )
        {
          if( (*((_DWORD *)v20 + 30) & 0x40000) == 0 )
          {
            v22 = *(_DWORD *)(a1 + 684) >> 5;
            v33 = *((_QWORD *)v20 + 1) & (-1i64 << (*(_DWORD *)(a1 + 684) & 0x1F));
            for( j = (char *)(*(_QWORD *)(a1 + 688)
                             + 8i64
                             * ((37
                               * (BYTE6(v33)
                                + 37
                                * (BYTE5(v33)
                                 + 37
                                 * (BYTE4(v33)
                                  + 37
                                  * (BYTE3(v33)
                                   + 37 * (BYTE2(v33) + 37 * (BYTE1(v33) + 37 * ((unsigned __int8)v33 + 11623883)))))))
                               + HIBYTE(v33)) & (unsigned int)(v22 - 1))); (*(_QWORD *)j & 1) == 0; j = *(char **)j )
            {
              if( *(char **)j == v20 )
              {
                *(_QWORD *)j = *(_QWORD *)v20;
                --*(_DWORD *)(a1 + 680);
                break;
              }
            }
            *(_QWORD *)v20 = 0i64;
          }
          v24 = v20 + 16;
          if( *((_QWORD *)v20 + 2) )
          {
            v25 = *(_DWORD *)(a1 + 700) >> 5;
            v33 = *((_QWORD *)v20 + 3) & (-1i64 << (*(_DWORD *)(a1 + 700) & 0x1F));
            for( k = (_QWORD *)(*(_QWORD *)(a1 + 704)
                               + 8i64
                               * ((37
                                 * (BYTE6(v33)
                                  + 37
                                  * (BYTE5(v33)
                                   + 37
                                   * (BYTE4(v33)
                                    + 37
                                    * (BYTE3(v33)
                                     + 37 * (BYTE2(v33) + 37 * (BYTE1(v33) + 37 * ((unsigned __int8)v33 + 11623883)))))))
                                 + HIBYTE(v33)) & (unsigned int)(v25 - 1))); (*k & 1) == 0; k = (_QWORD *)*k )
            {
              if( (_QWORD *)*k == v24 )
              {
                *k = *v24;
                --*(_DWORD *)(a1 + 696);
                break;
              }
            }
            *v24 = 0i64;
          }
          v27 = v20 + 72;
          v28 = *((_QWORD *)v20 + 9);
          if( *(char **)(v28 + 8) != v20 + 72 )
            goto LABEL_54;
          v29 = (_QWORD *)*((_QWORD *)v20 + 10);
          if( (_QWORD *)*v29 != v27 )
            goto LABEL_54;
          *v29 = v28;
          *(_QWORD *)(v28 + 8) = v29;
          v30 = (_OWORD **)*((_QWORD *)&v34 + 1);
          --*(_DWORD *)(a1 + 728);
          if( *v30 != &v34 )
            goto LABEL_54;
          *((_QWORD *)v20 + 10) = v30;
          *v27 = &v34;
          *v30 = v27;
          *((_QWORD *)&v34 + 1) = v20 + 72;
        }
      }
      *(_DWORD *)(a1 + 732) = 0;
      *(_DWORD *)(a1 + 1124) = 0;
      *(_QWORD *)(a1 + 672) = 0i64;
      if( (_InterlockedExchangeAdd64(v7, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock((_EX_PUSH_LOCK *)(a1 + 664));
      KeAbPostRelease((VOID *)(a1 + 664));
      KeLeaveCriticalRegionThread(KeGetCurrentThread());
      while( 1 )
      {
        result = v34;
        if( (__int128 *)v34 == &v34 )
          break;
        if( *(__int128 **)(v34 + 8) != &v34 )
          goto LABEL_54;
        v31 = *(_QWORD *)v34;
        if( *(_QWORD *)(*(_QWORD *)v34 + 8i64) != (_QWORD)v34 )
          goto LABEL_54;
        *(_QWORD *)&v34 = *(_QWORD *)v34;
        v32 = (void *)(result - 72);
        *(_QWORD *)(v31 + 8) = &v34;
        *(_QWORD *)(result - 72 + 64) = 0i64;
        *(_QWORD *)(result + 8) = result;
        *(_QWORD *)result = result;
        EtwpCovSampModuleCleanup(result - 72);
        ExFreePoolWithTag(v32, 0x56777445u);
      }
      _InterlockedExchange((volatile __int32 *)(a1 + 1128), 0);
    }
  }
  return result;
}

Referenced by:

EtwpCovSampContextGetModule
EtwpCoverageSamplerQuery