EtwpTraceStackKey

UINT8 __stdcall EtwpTraceStackKey(
        UINT64 LoggerId,
        UINT64 Flags,
        UINT16 HookId,
        EVENT_DATA_DESCRIPTOR *EventData,
        PVOID *StackTrace,
        UINT64 FrameCount){
  __int64 v6; 
  UINT8 v7; 
  unsigned int v8; 
  unsigned __int64 v9; 
  unsigned int v10; 
  PSLIST_ENTRY v11; 
  unsigned int v12; 
  __int64 v13; 
  __int64 v14; 
  int v15; 
  __int64 v16; 
  int v17; 
  _SLIST_ENTRY *v18; 
  __int64 CurrentIrql; 
  PSLIST_ENTRY Next; 
  unsigned int v21; 
  int v22; 
  PSLIST_ENTRY v23; 
  unsigned int v24; 
  _SLIST_ENTRY *v25; 
  PSLIST_ENTRY *v26; 
  _SLIST_ENTRY *v27; 
  PSLIST_ENTRY *v28; 
  unsigned int v29; 
  PSLIST_ENTRY v30; 
  PSLIST_ENTRY v31; 
  unsigned int v32; 
  struct _SLIST_ENTRY *v33; 
  PSLIST_ENTRY *v34; 
  UINT64 Flag; 
  UINT64 v37; 
  int v38; 
  unsigned int v39; 
  PSLIST_HEADER ListHead; 
  unsigned int v41; 
  INT64 **v42; 
  PSLIST_ENTRY v43; 
  PSLIST_ENTRY ListEntry; 
  PKSPIN_LOCK SpinLock; 
  _SLIST_ENTRY *v46; 
  __int64 v47; 
  int v49; 
  v49 = Flags;
  v6 = *(_QWORD *)(LoggerId + 992);
  v7 = 0;
  v43 = 0i64;
  v42 = (INT64 **)v6;
  if( !v6 )
    return v7;
  v8 = FrameCount;
  ListEntry = 0i64;
  v9 = 4i64 * (unsigned int)FrameCount;
  v10 = 0;
  v39 = 0;
  v11 = 0i64;
  v12 = 0;
  if( v9 )
  {
    v13 = 0i64;
    do
    {
      v14 = v12 + 1;
      v12 += 2;
      v15 = *((unsigned __int16 *)StackTrace + v13) ^ *((unsigned __int16 *)StackTrace + v14);
      v13 = v12;
      v10 += v15;
    }
    while( v12 < v9 );
    v8 = FrameCount;
    v39 = v10;
  }
  v16 = v10 % *(_DWORD *)(v6 + 8);
  v17 = 0;
  v18 = (_SLIST_ENTRY *)(v6 + 8 * (v16 + 2 * (v16 + 2)));
  v46 = v18;
  CurrentIrql = KeGetCurrentIrql();
  v47 = CurrentIrql;
  if( (unsigned __int8)CurrentIrql <= 1u )
  {
    KeGetCurrentIrql();
    __writecr8(2ui64);
  }
  else if( (_BYTE)CurrentIrql != 2 )
  {
    SpinLock = (PKSPIN_LOCK)&v18[1];
    if( !KxTryToAcquireSpinLock((volatile INT32 *)&v18[1]) )
      return v7;
    v17 = 0;
    goto LABEL_10;
  }
  SpinLock = (PKSPIN_LOCK)&v18[1];
  KxAcquireSpinLock((UINT64 *)&v18[1]);
LABEL_10:
  Next = v18->Next;
  if( v18->Next != v18 )
  {
    v21 = v39;
    do
    {
      ++v17;
      if( *((_DWORD *)&Next[1].Next + 3) == v21 && LODWORD(Next[2].Next) == v8 )
      {
        v22 = 0;
        v23 = Next;
        v38 = 0;
        ListHead = (PSLIST_HEADER)Next;
        while( 1 )
        {
          v24 = 32;
          if( LODWORD(v23[2].Next) < 0x20 )
            v24 = (unsigned int)v23[2].Next;
          v41 = v24;
          if( RtlCompareMemory(&v23[2].Next + 1, &StackTrace[v22], 8i64 * v24) != 8i64 * v24 )
            break;
          v22 = v41 + v38;
          v38 += v41;
          v23 = (PSLIST_ENTRY)*((_QWORD *)ListHead + 2);
          ListHead = (PSLIST_HEADER)v23;
          if( !v23 )
          {
            _InterlockedIncrement((volatile signed __int32 *)&Next[1].Next + 2);
            v25 = Next->Next;
            v26 = (PSLIST_ENTRY *)*((_QWORD *)&Next->Next + 1);
            if( *(&Next->Next->Next + 1) == Next && *v26 == Next )
            {
              *v26 = v25;
              *((_QWORD *)&v25->Next + 1) = v26;
              v27 = v18->Next;
              if( *(&v18->Next->Next + 1) == v18 )
              {
                Next->Next = v27;
                *((_QWORD *)&Next->Next + 1) = v18;
                *((_QWORD *)&v27->Next + 1) = Next;
                v18->Next = Next;
                KxReleaseSpinLock((UINT64 *)&v18[1]);
                __writecr8((unsigned __int8)CurrentIrql);
                goto LABEL_54;
              }
            }
LABEL_51:
            __fastfail(3u);
          }
        }
        v21 = v39;
      }
      Next = Next->Next;
    }
    while( Next != v18 );
    if( v17 == 4 )
    {
      v11 = (PSLIST_ENTRY)*((_QWORD *)&v18->Next + 1);
      ListEntry = v11;
      v28 = (PSLIST_ENTRY *)*((_QWORD *)&v11->Next + 1);
      if( v11->Next != v18 || *v28 != v11 )
        goto LABEL_51;
      *((_QWORD *)&v18->Next + 1) = v28;
      *v28 = v18;
    }
  }
  Next = 0i64;
  v29 = 0;
  if( !v8 )
    goto LABEL_50;
  v30 = 0i64;
  while( 1 )
  {
    v31 = RtlpInterlockedPopEntrySList((PSLIST_HEADER)(v42 + 2));
    if( !v31 )
      break;
    if( v29 + 32 >= (unsigned int)FrameCount )
      v32 = FrameCount - v29;
    else
      v32 = 32;
    memmove((UINT8 *)&v31[2].Next + 8, (UINT8 *)&StackTrace[v29], 8i64 * v32);
    if( v29 )
      LODWORD(v31[2].Next) = v32;
    else
      Next = v31;
    if( v30 )
      v30[1].Next = v31;
    v30 = v31;
    v31[1].Next = 0i64;
    v8 = FrameCount;
    v29 += v32;
    if( v29 >= (unsigned int)FrameCount )
      goto LABEL_45;
  }
  v8 = FrameCount;
LABEL_45:
  v18 = v46;
  LOBYTE(CurrentIrql) = v47;
  v11 = ListEntry;
  if( v29 < v8 )
  {
    KxReleaseSpinLock(SpinLock);
    __writecr8((unsigned __int8)v47);
    if( Next )
    {
      do
      {
        v33 = Next[1].Next;
        RtlpInterlockedPushEntrySList((PSLIST_HEADER)(v42 + 2), Next);
        Next = v33;
      }
      while( v33 );
    }
    if( ListEntry )
      EtwpDereferenceStackEntry((INT64)ListEntry, v42);
  }
  else
  {
LABEL_50:
    *((_DWORD *)&Next[1].Next + 3) = v39;
    LODWORD(Next[2].Next) = v8;
    *((_DWORD *)&Next[1].Next + 2) = 2;
    v34 = (PSLIST_ENTRY *)*((_QWORD *)&v18->Next + 1);
    if( *v34 != v18 )
      goto LABEL_51;
    Next->Next = v18;
    *((_QWORD *)&Next->Next + 1) = v34;
    *v34 = Next;
    *((_QWORD *)&v18->Next + 1) = Next;
    KxReleaseSpinLock((UINT64 *)&v18[1]);
    __writecr8((unsigned __int8)CurrentIrql);
    if( v11 )
      EtwpDereferenceStackEntry((INT64)v11, v42);
LABEL_54:
    v43 = Next;
    EventData[1].Ptr = (unsigned __int64)&v43;
    LODWORD(v37) = v49;
    *(_QWORD *)&EventData[1].Size = 8i64;
    LOWORD(Flag) = HookId;
    EtwpLogKernelEvent(EventData, *(_QWORD *)(LoggerId + 1080), *(unsigned int *)LoggerId, 2u, Flag, v37);
    EtwpDereferenceStackEntry((INT64)v43, *(INT64 ***)(LoggerId + 992));
    return 1;
  }
  return v7;
}

Referenced by: