EtwpCovSampProcessAddModule

INT64 __fastcall EtwpCovSampProcessAddModule(INT64 a1, PVOID *a2, INT64 a3, UINT64 a4){
  _ETHREAD *CurrentThread; 
  void *PoolWithTag; 
  volatile INT64 *v10; 
  int v11; 
  unsigned int v12; 
  unsigned int v13; 
  __int64 v14; 
  unsigned int v15; 
  unsigned int v16; 
  _ETHREAD *v17; 
  void *v18; 
  unsigned int v19; 
  __int64 v20; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  PoolWithTag = 0i64;
  --*((_WORD *)CurrentThread + 242);
  v10 = (volatile INT64 *)(a1 + 8);
  ExAcquirePushLockExclusiveEx(a1 + 8, 0i64);
  *(_QWORD *)(a1 + 16) = KeGetCurrentThread();
  if( !*(_QWORD *)a1 )
  {
    ObfReferenceObject(*a2);
    *(_QWORD *)a1 = a2;
  }
  if( (*(_DWORD *)(a3 + 120) & 0x110000) != 0 )
  {
    v11 = 0;
    while( 1 )
    {
      v12 = EtwpCovSampProcessRemoveModule(a1, a4, *(_QWORD *)(a3 + 40));
      v13 = *(_DWORD *)(a1 + 36);
      v14 = v12;
      v15 = *(_DWORD *)(a1 + 32);
      if( v15 < v13 )
        break;
      v16 = 2 * v13;
      if( !v13 )
        v16 = 16;
      *(_QWORD *)(a1 + 16) = 0i64;
      if( (_InterlockedExchangeAdd64(v10, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock(v10);
      KeAbPostRelease((PVOID)v10);
      KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
      if( PoolWithTag )
        ExFreePoolWithTag(PoolWithTag, 0x56777445u);
      PoolWithTag = ExAllocatePoolWithTag(PagedPool, 16i64 * v16, 0x56777445ui64);
      if( !PoolWithTag )
      {
        v19 = -1073741670;
        goto LABEL_25;
      }
      v17 = (_ETHREAD *)KeGetCurrentThread();
      --*((_WORD *)v17 + 242);
      ExAcquirePushLockExclusiveEx((UINT64)v10, 0i64);
      *(_QWORD *)(a1 + 16) = KeGetCurrentThread();
      if( v16 > *(_DWORD *)(a1 + 36) )
      {
        v18 = *(void **)(a1 + 24);
        if( v18 )
        {
          memmove((UINT8 *)PoolWithTag, *(UINT8 **)(a1 + 24), 16i64 * *(unsigned int *)(a1 + 32));
          v18 = *(void **)(a1 + 24);
        }
        *(_QWORD *)(a1 + 24) = PoolWithTag;
        PoolWithTag = v18;
        *(_DWORD *)(a1 + 36) = v16;
      }
      if( (unsigned int)++v11 >= 0x14 )
      {
        v19 = -1073741823;
        goto LABEL_25;
      }
    }
    v20 = *(_QWORD *)(a1 + 24) + 16 * v14;
    if( v15 > (unsigned int)v14 )
    {
      memmove((UINT8 *)(v20 + 16), (UINT8 *)(*(_QWORD *)(a1 + 24) + 16 * v14), 16i64 * (v15 - (unsigned int)v14));
      v15 = *(_DWORD *)(a1 + 32);
    }
    *(_DWORD *)(a1 + 32) = v15 + 1;
    *(_QWORD *)v20 = a4 + *(_QWORD *)(a3 + 40);
    EtwpCovSampModuleReference(*(_QWORD *)a1, a3);
    *(_QWORD *)(v20 + 8) = a3;
  }
  else
  {
    EtwpCovSampProcessRemoveModule(a1, a4, *(_QWORD *)(a3 + 40));
  }
  v19 = 0;
LABEL_25:
  if( *(struct _KTHREAD **)(a1 + 16) == KeGetCurrentThread() )
  {
    *(_QWORD *)(a1 + 16) = 0i64;
    if( (_InterlockedExchangeAdd64(v10, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(v10);
    KeAbPostRelease((PVOID)v10);
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  }
  if( PoolWithTag )
    ExFreePoolWithTag(PoolWithTag, 0x56777445u);
  return v19;
}

Referenced by: