EtwpCovSampCaptureKernelStack

INT64 __fastcall EtwpCovSampCaptureKernelStack(INT64 a1, UINT64 a2){
  unsigned int v2; 
  unsigned int v3; 
  int v5; 
  __int64 v6; 
  char v7; 
  int v8; 
  unsigned int v9; 
  unsigned int v10; 
  int v11; 
  unsigned int v12; 
  __int64 v14[5]; 
  unsigned int v15; 
  UINT64 v16; 
  v2 = 0;
  v3 = a2;
  v16 = 0i64;
  v14[0] = 0i64;
  v15 = 0;
  if( !KeQueryCurrentStackInformation((_KERNEL_STACK_LIMITS *)&v15, (UINT64 *)v14, &v16) )
    return(unsigned int)-1073741637;
  if( v15 <= 9 && (v5 = 929, _bittest(&v5, v15)) )
  {
    return(unsigned int)-1073741637;
  }
  else
  {
    v6 = *(unsigned __int16 *)(a1 + 62);
    v7 = v3;
    v8 = *(unsigned __int16 *)(a1 + 60);
    v9 = 0;
    v10 = v3 >> 28;
    v11 = v7 & 2;
    if( !v11 )
      v9 = v10;
    if( (unsigned __int16)v8 < (unsigned __int16)v6 )
    {
      return(unsigned int)-1073741595;
    }
    else
    {
      v12 = RtlWalkFrameChain((VOID **)(a1 + 64 + 8 * v6), v9 + v8 - (_DWORD)v6, (v9 << 8) | (v11 != 0 ? 2 : 0));
      if( v12 > v9 )
      {
        *(_DWORD *)(a1 + 56) |= 1u;
        *(_WORD *)(a1 + 62) += v12 - v9;
        EtwpCovSampCaptureBufferOptimizeIP(a1);
      }
      else
      {
        return(unsigned int)-1073741275;
      }
    }
  }
  return v2;
}

Referenced by: