EtwpCovSampCaptureBufferGet

struct SLIST_ENTRY *__fastcall EtwpCovSampCaptureBufferGet(INT64 a1){
  unsigned int v2; 
  __int64 v3; 
  unsigned int v4; 
  __int64 v5; 
  __int64 v6; 
  struct SLIST_ENTRY *result; 
  v2 = ((unsigned int)*(_QWORD *)(a1 + 8) >> 13) & 0x3FFFF;
  v3 = *(_QWORD *)(a1 + 8) >> 4;
  _BitScanReverse(&v4, v2);
  v5 = v3 & 0x1FF;
  v6 = *(_QWORD *)(*(_QWORD *)(*((_QWORD *)KeGetCurrentPrcb() + 4198) + 8i64 * (v4 - 2)) + 8i64 * (v2 ^ (1 << v4)) + 8);
  result = EtwpCovSampLookasidePop(a1, v6 + 8 * (v5 + 10));
  if( result )
  {
    *((_WORD *)&result[3].Next + 7) = 0;
    *((_DWORD *)&result[3].Next + 2) = 0;
  }
  else
  {
    _InterlockedIncrement((volatile signed __int32 *)(v6 + 8 * v5 + 312));
  }
  return result;
}

Referenced by: