EtwpTraceLastBranchRecord

void __fastcall EtwpTraceLastBranchRecord(unsigned int *a1, _QWORD *a2, _ETHREAD *a3, int a4){
  _ETHREAD *v6; 
  _ETHREAD *CurrentThread; 
  int v9; 
  char v10; 
  __int64 v11; 
  PSLIST_ENTRY v12; 
  _KPROFILE_SOURCE v13; 
  UINT64 v14; 
  _KERNEL_STACK_LIMITS *p_Type; 
  __int64 v16; 
  __int64 v17; 
  void *v18; 
  _ETW_SILODRIVERSTATE *v19; 
  __int64 v20; 
  int v21; 
  unsigned int v22; 
  unsigned int v23; 
  _KERNEL_STACK_LIMITS Type; 
  int v25; 
  UINT64 LowLimit; 
  UINT64 HighLimit; 
  __int128 v28; 
  __int128 v29; 
  __int128 v30; 
  __int128 *v31; 
  int v32; 
  int v33; 
  _KERNEL_STACK_LIMITS *v34; 
  int v35; 
  int v36; 

  v25 = 0;
  v28 = 0i64;
  v6 = a3;
  v29 = 0i64;
  HighLimit = 0i64;
  v30 = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  LowLimit = 0i64;
  Type = BugcheckStackLimits;
  if( KeGetCurrentPrcb()->IdleThread != CurrentThread && (a4 & 0x1800) != 0 )
  {
    if( !a3 )
      v6 = CurrentThread;
    if( KeQueryCurrentStackInformation(&Type, &LowLimit, &HighLimit) )
    {
      if( (unsigned int)Type > MachineCheckStackLimits || (v9 = 929, !_bittest(&v9, Type)) )
      {
        v10 = 0;
        v11 = (unsigned int)(24 * EtwpLastBranchStackSize);
        v12 = RtlpInterlockedPopEntrySList(&xmmword_140C53AB0);
        if( !v12 || (p_Type = (_KERNEL_STACK_LIMITS *)&v12[1], v12 == (PSLIST_ENTRY)-16i64) )
        {
          LODWORD(v16) = KeGetCurrentStackPointer(v14, v13);
          if( v16 - LowLimit <= v11 + 3632 )
            return;
          v17 = v11 + 15;
          if( v11 + 15 <= (unsigned __int64)(unsigned int)v11 )
            v17 = 0xFFFFFFFFFFFFFF0i64;
          v18 = alloca(v17 & 0xFFFFFFFFFFFFFFF0ui64);
          v10 = 1;
          p_Type = &Type;
        }
        if( ((int(__fastcall *)(_QWORD, _KERNEL_STACK_LIMITS *, int *))off_140C00988[0])(
               (unsigned int)v11,
               p_Type,
               &v25) >= 0
          && v25 )
        {
          v19 = (_ETW_SILODRIVERSTATE *)*((_QWORD *)a1 + 135);
          DWORD2(v28) = v6->Cid.UniqueProcess;
          HIDWORD(v28) = v6->Cid.UniqueThread;
          *(_QWORD *)&v28 = *a2;
          v20 = *((_QWORD *)a1 + 126);
          v23 = a4 & 0xFFFFE600 | 2;
          v21 = *(_DWORD *)(v20 + 4);
          v33 = 0;
          v36 = 0;
          v31 = &v28;
          LODWORD(v29) = v21;
          v35 = v25;
          v22 = *a1;
          v32 = 24;
          v34 = p_Type;
          EtwpLogKernelEvent((__int64)&v31, v19, v22, 2u, 0xC20u, v23);
        }
        if( !v10 )
          RtlpInterlockedPushEntrySList(&xmmword_140C53AB0, (PSLIST_ENTRY)p_Type - 1);
      }
    }
  }
}

Referenced by: