EtwpStackTraceDispatcher

void __fastcall EtwpStackTraceDispatcher(__int64 a1, _QWORD *a2, __int64 a3, unsigned int a4){
  _ETHREAD *CurrentThread; 
  unsigned int v5; 
  __int64 v6; 
  UINT8 CurrentIrql; 
  unsigned __int8 v10; 
  unsigned __int8 v11; 
  char v12; 
  int v13; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v5 = a4;
  v6 = a3;
  if( (a4 & 0x4000) == 0 || *((_ETHREAD **)KeGetCurrentPrcb() + 3) != CurrentThread )
  {
    if( !a3 )
      v6 = (__int64)CurrentThread;
    if( (a4 & 0x3000) != 4096 )
      goto LABEL_29;
    if( (*((_DWORD *)CurrentThread + 29) & 0x400) != 0
      || CurrentThread != (_ETHREAD *)v6
      || (*((_DWORD *)CurrentThread + 324) & 1) != 0 && (a4 & 0x4000000) == 0 )
    {
      v5 = a4 & 0xFFFFEFFF;
      goto LABEL_29;
    }
    CurrentIrql = ObGetCurrentIrql();
    v10 = 2;
    v11 = CurrentIrql;
    if( CurrentIrql < 2u )
    {
      if( (*(_DWORD *)(a1 + 832) & 0x1000000) == 0 || (*((_DWORD *)CurrentThread + 324) & 1) != 0 )
      {
        MmCanThreadFault();
        if( v13 )
        {
          if( !*((_BYTE *)CurrentThread + 1310)
            && *((_BYTE *)KeGetCurrentThread() + 586) != 1
            && (v5 & 0x1000000) == 0
            && !_bittest((const signed __int32 *)CurrentThread + 29, 5u) )
          {
            goto LABEL_29;
          }
        }
      }
      v5 &= ~0x1000u;
    }
    else
    {
      v5 &= ~0x1000u;
      v12 = *((_BYTE *)KeGetCurrentPrcb() + 32);
      if( CurrentIrql == 2 )
      {
        if( !v12 )
          goto LABEL_28;
        goto LABEL_16;
      }
      if( v12 )
      {
LABEL_16:
        if( (v5 & 0x8000) == 0 || v12 != 1 )
          goto LABEL_29;
      }
    }
    v10 = v11;
LABEL_28:
    EtwpQueueStackWalkApc((__int64)CurrentThread, v10, (unsigned int *)a1, (unsigned int *)a2);
LABEL_29:
    if( (v5 & 0x1800) != 0 )
      EtwpTraceStackWalk(a1, v5, v6, a2);
  }
}

Referenced by: