KiTpSetupCompletion

NTSTATUS __stdcall KiTpSetupCompletion(ULONG_PTR rcx0, CHAR a2, VOID *a4, VOID *Size, UINT64 Sizea, CHAR *a6){
  _EPROCESS *v9; 
  unsigned int v10; 
  int ImageData; 
  UINT64 v13; 
  UINT64 v14; 

  v9 = *(_EPROCESS **)&rcx0;
  *(_OWORD *)a6 = 0i64;
  *((_OWORD *)a6 + 1) = 0i64;
  *((_QWORD *)a6 + 4) = 0i64;
  v10 = 4096 - ((unsigned __int16)a4 & 0xFFF);
  if( v10 > 0xF )
    v10 = 15;
  LODWORD(v13) = v10;
  ImageData = KiTpReadImageData(*(_EPROCESS **)&rcx0, a2, a4, a6 + 6, v13);
  if( ImageData >= 0 )
  {
    a6[5] = v10;
    ImageData = KiTpParseInstruction(a6);
    if( ImageData == -1073741306 )
    {
      if( v10 >= 0xF )
        return ImageData;
      LODWORD(v14) = 15;
      *(_OWORD *)a6 = 0i64;
      *((_OWORD *)a6 + 1) = 0i64;
      *((_QWORD *)a6 + 4) = 0i64;
      ImageData = KiTpReadImageData(v9, a2, a4, a6 + 6, v14);
      if( ImageData < 0 )
        return ImageData;
      a6[5] = 15;
      ImageData = KiTpParseInstruction(a6);
    }
    if( ImageData >= 0 )
      memmove(Size, a6 + 6, Sizea);
  }
  return ImageData;
}

Referenced by:

KeSetTracepoint