EtwpCovSampCaptureQueueApc

NTSTATUS __stdcall EtwpCovSampCaptureQueueApc(PVOID SystemArgument1){
  _ETHREAD *CurrentThread; 
  _SLIST_ENTRY *v2; 
  INT64 v3; 
  int v4; 
  int v5; 
  NTSTATUS v7; 
  __int64 v8; 
  unsigned int v9; 
  unsigned int v10; 
  __int64 v11; 
  _SLIST_ENTRY *v12; 
  _KAPC *v13; 
  unsigned __int8 CurrentIrql; 
  char v15; 
  _ETHREAD *v16; 
  INT64 v17; 
  INT64 Next; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v2 = 0i64;
  v3 = *(&ExBootDevicesRemovedEvent + 153);
  v4 = 0;
  v5 = 0;
  if( CurrentThread->Tcb.Process->Pcb.FreezeCount
     + (((unsigned __int32)CurrentThread->Tcb.Process->Pcb._bf_0 >> 3) & 1)
    || CurrentThread->Tcb.SuspendCount
    || (CurrentThread->Tcb._bf_0 & 0x4000) == 0 )
  {
    v7 = -1073741637;
  }
  else
  {
    if( _interlockedbittestandset((volatile signed __int32 *)&CurrentThread->1296, 0x17u) )
      return -1073740008;
    v4 = 1;
    v8 = (*(_QWORD *)(v3 + 8) >> 4) & 0x1FFi64;
    v9 = ((unsigned int)*(_QWORD *)(v3 + 8) >> 13) & 0x3FFFF;
    _BitScanReverse(&v10, v9);
    v11 = *(_QWORD *)(*((_QWORD *)KeGetCurrentPrcb()->ExSaPageArray + v10 - 2) + 8i64 * (v9 ^ (1 << v10)) + 8);
    v12 = EtwpCovSampLookasidePop(v3, v11 + 8 * (v8 + 2));
    v2 = v12;
    if( !v12 )
    {
      _InterlockedIncrement((volatile signed __int32 *)(v11 + 8 * v8 + 308));
      v7 = -1073741670;
LABEL_24:
      _InterlockedAnd((volatile signed __int32 *)&CurrentThread->1296, 0xFF7FFFFF);
      return v7;
    }
    v13 = (_KAPC *)(&v12[3].Next + 1);
    KeInitializeApc(
      (INT64)(&v12[3].Next + 1),
      (INT64)CurrentThread,
      0i64,
      (INT64)EtwpCovSampCaptureApc,
      (INT64)EtwpCovSampCaptureApcRundown,
      (INT64)EtwpCovSampCaptureApc,
      0,
      v3);
    *((_QWORD *)&v2[7].Next + 1) = 0i64;
    LODWORD(v2[9].Next) = KUSER_SHARED_DATA.TickCount.LowPart;
    CurrentIrql = KeGetCurrentIrql();
    if( CurrentIrql <= 2u )
    {
      if( CurrentIrql < 2u )
      {
        v16 = (_ETHREAD *)KeGetCurrentThread();
        --v16->Tcb.KernelApcDisable;
        v5 = 1;
      }
      if( !KeInsertQueueApc((INT64)v13, (INT64)SystemArgument1, 0i64, 0i64) )
      {
        v7 = -1073741823;
        goto LABEL_19;
      }
    }
    else
    {
      KeTryToInsertQueueApc(v13, SystemArgument1, 0i64);
      if( !v15 )
      {
        if( (CurrentThread->Tcb._bf_0 & 0x4000) != 0 )
          KeIsThreadRunning(&CurrentThread->Tcb);
        v7 = -1073741823;
        goto LABEL_21;
      }
    }
    v4 = 0;
    v2 = 0i64;
    v7 = 0;
  }
LABEL_19:
  if( v5 )
    KeLeaveCriticalRegion();
LABEL_21:
  if( v2 )
  {
    v17 = *(&ExBootDevicesRemovedEvent + 153);
    memset(&v2[3].Next + 1, 0i64, 0x58u);
    Next = (INT64)v2[3].Next;
    LODWORD(v2[9].Next) = 0;
    EtwpCovSampCaptureReleaseToLookaside(v17, Next, (PFN_WDFUSBTARGETDEVICECREATE *)v2);
  }
  if( v4 )
    goto LABEL_24;
  return v7;
}

Referenced by: