EtwSetProcessTelemetryCoverage

INT64 __fastcall EtwSetProcessTelemetryCoverage(__int64 a1, __int64 a2){
  INT64 v3; 
  unsigned int v4; 
  INT64 result; 
  int v6; 
  if( a1 != *((_QWORD *)KeGetCurrentThread() + 23) )
    return 3221225659i64;
  if( EtwpCoverageContext || (result = EtwpCoverageEnsureContext(), (int)result >= 0) )
  {
    v3 = EtwpCoverageContext;
    if( (*(_DWORD *)(a2 + 16) & 1) != 0 )
    {
      *(_DWORD *)(a2 + 12) = -1;
    }
    else
    {
      v4 = *(_DWORD *)(a2 + 12);
      if( v4 < 0xFFFFFF00 )
      {
        EtwpCoverageRecord((INT64 **)EtwpCoverageContext, a2);
        result = EtwpCoverageEnsureUserModeView(v3);
        if( (int)result < 0 )
          return result;
        return 0i64;
      }
      switch( v4 )
      {
        case 0xFFFFFFFE:
          v6 = EtwpCoverageCheckCP(EtwpCoverageContext, a2);
          goto LABEL_16;
        case 0xFFFFFFFD:
          v6 = EtwpCoverageResetCP(EtwpCoverageContext, a2);
LABEL_16:
          if( !v6 )
            return 3221226021i64;
          return 0i64;
        case 0xFFFFFFFC:
          if( !EtwpCoverageUserIsAdmin() )
            return 3221225506i64;
          EtwpCoverageReset(v3, 1);
          *(_DWORD *)(a2 + 12) = *(_DWORD *)(*(_QWORD *)(v3 + 16) + 24i64);
          return 0i64;
        case 0xFFFFFFFB:
          EtwpCoverageRecordAtHighIrql(a2);
          return 0i64;
      }
    }
    return 3221225485i64;
  }
  return result;
}

Referenced by: