EtwpCoverageReset

_ETHREAD *__stdcall EtwpCoverageReset(INT64 a1, CHAR a2){
  _ETHREAD *CurrentThread; 
  __int64 v5; 
  _ETHREAD *result; 
  int v7; 

  if( *(_DWORD *)(*(_QWORD *)(a1 + 16) + 32i64) )
  {
    if( dword_140C0EF3C < KUSER_SHARED_DATA.TelemetryCoverageRound )
    {
      if( !dword_140C0EF38 )
        dword_140C0EF38 = TelemetryCoverageStringHashInternal((_BYTE *)off_140C0EF30, &v7);
      EtwTelemetryCoverageReport((INT64)&off_140C0EF30);
    }
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)&ExBootDevicesRemovedEvent + 166, 0i64);
    qword_140C50300 = (__int64)KeGetCurrentThread();
    if( (a2 & 4) == 0 || (*(_DWORD *)(a1 + 36) & 1) != 0 )
    {
      if( (a2 & 1) != 0
        || (unsigned int)((KUSER_SHARED_DATA.TickCountQuad * KUSER_SHARED_DATA.TickCountMultiplier) >> 24)
         - *(_DWORD *)(a1 + 24) > 0x927C0 )
      {
        *(_DWORD *)(a1 + 36) &= ~1u;
        EtwpCoverageFlushPending(a1);
        memset((VOID *)(*(_QWORD *)(a1 + 16) + 52i64), 0i64, 4 * *(_DWORD *)(*(_QWORD *)(a1 + 16) + 4i64));
        EtwpCoverageFreeStringBuffers(a1, 1i64);
        *(_DWORD *)(*(_QWORD *)a1 + 4i64) = 0;
        **(_DWORD **)a1 = ++*(_DWORD *)(*(_QWORD *)(a1 + 16) + 24i64);
        v5 = *(_QWORD *)(a1 + 16);
        if( (*(_BYTE *)(v5 + 2) & 1) == 0 )
          KUSER_SHARED_DATA.TelemetryCoverageRound = *(_DWORD *)(v5 + 24);
        *(_DWORD *)(*(_QWORD *)(a1 + 16) + 20i64) = (KUSER_SHARED_DATA.TickCountQuad
                                                   * KUSER_SHARED_DATA.TickCountMultiplier) >> 24;
        *(_DWORD *)(*(_QWORD *)a1 + 20i64) = *(_DWORD *)(*(_QWORD *)(a1 + 16) + 20i64);
        *(_DWORD *)(*(_QWORD *)(a1 + 16) + 32i64) = 0;
      }
      else
      {
        *(_DWORD *)(a1 + 36) |= 1u;
      }
    }
  }
  result = (_ETHREAD *)KeGetCurrentThread();
  if( (_ETHREAD *)qword_140C50300 == result )
  {
    qword_140C50300 = 0i64;
    if( (_InterlockedExchangeAdd64((_QWORD *)&ExBootDevicesRemovedEvent + 166, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((_EX_PUSH_LOCK *)&ExBootDevicesRemovedEvent + 166);
    KeAbPostRelease((char *)&ExBootDevicesRemovedEvent + 1328);
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
  }
  return result;
}

Referenced by: