EtwpStackTraceDispatcher

VOID __stdcall EtwpStackTraceDispatcher(
        UINT64 LoggerId,
        _LARGE_INTEGER *RelatedTimeStamp,
        _ETHREAD *Thread,
        UINT64 Flags,
        UINT64 Flagsa){
  _ETHREAD *CurrentThread; 
  unsigned int v6; 
  _ETHREAD *v7; 
  UINT8 CurrentIrql; 
  UINT8 v11; 
  UINT8 v12; 
  unsigned __int8 NestingLevel; 
  int v14; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v6 = Flags;
  v7 = Thread;
  if( (Flags & 0x4000) == 0 || KeGetCurrentPrcb()->IdleThread != CurrentThread )
  {
    if( !Thread )
      v7 = CurrentThread;
    if( (Flags & 0x3000) != 4096 )
      goto LABEL_29;
    if( (CurrentThread->Tcb._bf_0 & 0x400) != 0
      || CurrentThread != v7
      || (CurrentThread->CrossThreadFlags & 1) != 0 && (Flags & 0x4000000) == 0 )
    {
      v6 = Flags & 0xFFFFEFFF;
      goto LABEL_29;
    }
    CurrentIrql = ObGetCurrentIrql();
    v11 = 2;
    v12 = CurrentIrql;
    if( CurrentIrql < 2u )
    {
      if( (*(_DWORD *)(LoggerId + 832) & 0x1000000) == 0 || (CurrentThread->CrossThreadFlags & 1) != 0 )
      {
        MmCanThreadFault();
        if( v14 )
        {
          if( !CurrentThread->ActiveFaultCount
            && KeGetCurrentThread()->ApcStateIndex != 1
            && (v6 & 0x1000000) == 0
            && !_bittest((const signed __int32 *)&CurrentThread->Tcb.116, 5u) )
          {
            goto LABEL_29;
          }
        }
      }
      v6 &= ~0x1000u;
    }
    else
    {
      v6 &= ~0x1000u;
      NestingLevel = KeGetCurrentPrcb()->NestingLevel;
      if( CurrentIrql == 2 )
      {
        if( !NestingLevel )
          goto LABEL_28;
        goto LABEL_16;
      }
      if( NestingLevel )
      {
LABEL_16:
        if( (v6 & 0x8000) == 0 || NestingLevel != 1 )
          goto LABEL_29;
      }
    }
    v11 = v12;
LABEL_28:
    EtwpQueueStackWalkApc(CurrentThread, v11, LoggerId, RelatedTimeStamp);
LABEL_29:
    if( (v6 & 0x1800) != 0 )
      EtwpTraceStackWalk(LoggerId, v6, v7, RelatedTimeStamp);
  }
}

Referenced by: