EtwpCovSampCaptureQueueApc

NTSTATUS __stdcall EtwpCovSampCaptureQueueApc(PVOID SystemArgument1){
  _ETHREAD *CurrentThread; 
  struct SLIST_ENTRY *v2; 
  INT64 v3; 
  int v4; 
  int v5; 
  NTSTATUS v7; 
  __int64 v8; 
  unsigned int v9; 
  unsigned int v10; 
  __int64 v11; 
  struct SLIST_ENTRY *v12; 
  _KAPC *v13; 
  unsigned __int8 CurrentIrql; 
  _ETHREAD *v15; 
  INT64 v16; 
  INT64 Next; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v2 = 0i64;
  v3 = StartContext;
  v4 = 0;
  v5 = 0;
  if( *(_DWORD *)(*((_QWORD *)CurrentThread + 68) + 888i64)
     + ((*(_DWORD *)(*((_QWORD *)CurrentThread + 68) + 632i64) >> 3) & 1)
    || *((_BYTE *)CurrentThread + 644)
    || (*((_DWORD *)CurrentThread + 29) & 0x4000) == 0 )
  {
    v7 = -1073741637;
  }
  else
  {
    if( _interlockedbittestandset((volatile signed __int32 *)CurrentThread + 324, 0x17u) )
      return -1073740008;
    v4 = 1;
    v8 = (*(_QWORD *)(v3 + 8) >> 4) & 0x1FFi64;
    v9 = ((unsigned int)*(_QWORD *)(v3 + 8) >> 13) & 0x3FFFF;
    _BitScanReverse(&v10, v9);
    v11 = *(_QWORD *)(*(_QWORD *)(*((_QWORD *)KeGetCurrentPrcb() + 4198) + 8i64 * (v10 - 2))
                    + 8i64 * (v9 ^ (1 << v10))
                    + 8);
    v12 = EtwpCovSampLookasidePop(v3, v11 + 8 * (v8 + 2));
    v2 = v12;
    if( !v12 )
    {
      _InterlockedIncrement((volatile signed __int32 *)(v11 + 8 * v8 + 308));
      v7 = -1073741670;
LABEL_24:
      _InterlockedAnd((volatile signed __int32 *)CurrentThread + 324, 0xFF7FFFFF);
      return v7;
    }
    v13 = (_KAPC *)(&v12[3].Next + 1);
    KeInitializeApc(
      (INT64)(&v12[3].Next + 1),
      (INT64)CurrentThread,
      0i64,
      (INT64)EtwpCovSampCaptureApc,
      (INT64)EtwpCovSampCaptureApcRundown,
      (INT64)EtwpCovSampCaptureApc,
      0,
      v3);
    *((_QWORD *)&v2[7].Next + 1) = 0i64;
    LODWORD(v2[9].Next) = KUSER_SHARED_DATA.TickCount.LowPart;
    CurrentIrql = KeGetCurrentIrql();
    if( CurrentIrql <= 2u )
    {
      if( CurrentIrql < 2u )
      {
        v15 = (_ETHREAD *)KeGetCurrentThread();
        --*((_WORD *)v15 + 242);
        v5 = 1;
      }
      if( !KeInsertQueueApc(v13, SystemArgument1, 0i64, 0i64) )
      {
        v7 = -1073741823;
        goto LABEL_19;
      }
    }
    else if( !KeTryToInsertQueueApc(v13, SystemArgument1, 0i64) )
    {
      if( (*((_DWORD *)CurrentThread + 29) & 0x4000) != 0 )
        KeIsThreadRunning((__int64)CurrentThread);
      v7 = -1073741823;
      goto LABEL_21;
    }
    v4 = 0;
    v2 = 0i64;
    v7 = 0;
  }
LABEL_19:
  if( v5 )
    KeLeaveCriticalRegion();
LABEL_21:
  if( v2 )
  {
    v16 = StartContext;
    memset((INT64)(&v2[3].Next + 1), 0i64);
    Next = (INT64)v2[3].Next;
    LODWORD(v2[9].Next) = 0;
    EtwpCovSampCaptureReleaseToLookaside(v16, Next, v2);
  }
  if( v4 )
    goto LABEL_24;
  return v7;
}

Referenced by: