EtwpTraceStackWalk

void __fastcall EtwpTraceStackWalk(__int64 a1, unsigned int a2, __int64 a3, _QWORD *a4){
  int v6; 
  int v7; 
  KPROFILE_SOURCE v8; 
  UINT64 v9; 
  PSLIST_ENTRY StackLookasideListEntry; 
  __int64 v11; 
  void *v12; 
  unsigned int v13; 
  int v14; 
  unsigned int v15; 
  UINT64 v16; 
  unsigned int v17; 
  unsigned int v18; 
  PVOID *v19; 
  unsigned int v20; 
  unsigned int v21; 
  unsigned int v22; 
  unsigned int v23; 
  bool v24; 
  UINT64 v25; 
  UINT64 v26; 
  PVOID *StackTrace; 
  UINT64 FrameCount; 
  char v29; 
  _KERNEL_STACK_LIMITS Type; 
  UINT64 LowLimit; 
  UINT64 HighLimit; 
  __int64 v33; 
  _QWORD *v34; 
  __int128 v35; 
  __int64 v36; 
  EVENT_DATA_DESCRIPTOR EventData; 
  PSLIST_ENTRY v38; 
  unsigned int v39; 
  int v40; 
  v33 = a3;
  Type = BugcheckStackLimits;
  LowLimit = 0i64;
  HighLimit = 0i64;
  v34 = a4;
  v36 = 0i64;
  v35 = 0i64;
  if( !KeQueryCurrentStackInformation(&Type, &LowLimit, &HighLimit) )
    return;
  if( (unsigned int)Type <= MachineCheckStackLimits )
  {
    v6 = 929;
    if( _bittest(&v6, Type) )
      return;
  }
  v7 = 256;
  StackLookasideListEntry = EtwpGetStackLookasideListEntry();
  if( !StackLookasideListEntry )
  {
    LODWORD(v11) = KeGetCurrentStackPointer(v9, v8);
    if( v11 - LowLimit <= 0x1438 )
      return;
    v12 = alloca(1536i64);
    StackLookasideListEntry = (PSLIST_ENTRY)&v29;
    v7 = 192;
  }
  v13 = 0;
  v14 = 0;
  if( (*(_DWORD *)(a1 + 832) & 0x40000000) == 0 )
    goto LABEL_10;
  if( (a2 & 0x800) != 0 )
  {
    v13 = 1;
    StackLookasideListEntry->Next = (_SLIST_ENTRY *)PsNtosImageBase;
    a2 &= ~0x800u;
LABEL_10:
    if( (a2 & 0x800) != 0 )
    {
      v15 = (a2 >> 20) & 0xF;
      v16 = (v15 << 8) | 2;
      if( (a2 & 0x2000000) == 0 )
        v16 = ((a2 >> 20) & 0xF) << 8;
      v17 = RtlWalkFrameChain((VOID **)&StackLookasideListEntry->Next, v15 + v7, v16);
      if( v17 > v15 )
        v13 = v17 - v15;
      else
        v13 = 0;
    }
  }
  if( (a2 & 0x1000) != 0 )
  {
    v18 = v7 - v13;
    v19 = (PVOID *)(&StackLookasideListEntry->Next + v13);
    if( *(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2240i64) )
    {
      v14 = PsPicoWalkUserStack(v19, v18);
    }
    else
    {
      v20 = HIWORD(a2) & 0xF;
      v21 = RtlWalkFrameChain(v19, v18 + v20, (v20 << 8) | 1);
      if( v21 > v20 )
        v14 = v21 - v20;
      else
        v14 = 0;
    }
  }
  v22 = v13 + v14;
  if( v22 )
  {
    v23 = a2 & 0xFFFFE600 | 2;
    *(_QWORD *)&EventData.Size = 16i64;
    v24 = (*(_DWORD *)(a1 + 832) & 0x1000000) == 0;
    DWORD2(v35) = *(_DWORD *)(v33 + 1144);
    HIDWORD(v35) = *(_DWORD *)(v33 + 1152);
    *(_QWORD *)&v35 = *v34;
    EventData.Ptr = (unsigned __int64)&v35;
    if( v24
      || v22 < 4
      || (LODWORD(FrameCount) = v22,
          !EtwpTraceStackKey(
             a1,
             v23,
             6182 - (v13 != 0),
             &EventData,
             (PVOID *)&StackLookasideListEntry->Next,
             FrameCount)) )
    {
      v25 = *(unsigned int *)a1;
      v26 = *(_QWORD *)(a1 + 1080);
      v39 = 8 * v22;
      LODWORD(FrameCount) = v23;
      LOWORD(StackTrace) = 6176;
      v38 = StackLookasideListEntry;
      v40 = 0;
      EtwpLogKernelEvent(&EventData, v26, v25, 2u, (UINT64)StackTrace, FrameCount);
    }
  }
  if( v7 == 256 )
    RtlpInterlockedPushEntrySList((PSLIST_HEADER)&EtwpStackLookAsideList, StackLookasideListEntry - 1);
}

Referenced by: