EtwpDisableKernelTrace

__int64 __fastcall EtwpDisableKernelTrace(_DWORD *a1, int *a2, UINT64 *a3, UINT64 TraceClass){
  int v4; 
  int v8; 
  int v9; 
  int v10; 
  int v11; 
  int v12; 
  unsigned int i; 
  _ETHREAD *CurrentThread; 
  UINT64 TraceClassa; 

  v4 = TraceClass;
  if( a2 )
  {
    v8 = *a2;
    if( (*a2 & 0x20000) != 0 )
    {
      *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) = 0i64;
      CmpTraceTxrRoutine = 0i64;
    }
    if( (v8 & 0x100000) != 0 )
    {
      AlpcUnregisterLogRoutine();
      v8 = *a2;
    }
    if( (v8 & 0x2000000) != 0 )
    {
      qword_140C00EF8 = 0i64;
      v8 = *a2;
    }
    if( (v8 & 0x4000000) != 0 )
    {
      qword_140C00EF0 = 0i64;
      v8 = *a2;
    }
    if( (v8 & 0x200) != 0 )
    {
      qword_140C00EE8 = 0i64;
      v8 = *a2;
    }
    if( (v8 & 0x100) != 0 )
    {
      EtwpDiskIoNotifyRoutines = 0i64;
      qword_140C00ED8 = 0i64;
      v8 = *a2;
    }
    if( (v8 & 0x400) != 0 )
      qword_140C544A8 = 0i64;
    v9 = a2[4];
    if( (v9 & 1) != 0 )
    {
      qword_140C544B0 = 0i64;
      v9 = a2[4];
    }
    if( (v9 & 2) != 0 )
      qword_140C544B8 = 0i64;
    v10 = *a2;
    if( (*a2 & 0x200000) != 0 )
    {
      qword_140CED0D8 = 0i64;
      v10 = *a2;
    }
    if( (v10 & 0x10000) != 0 )
      WmiSetNetworkNotify(0i64);
    if( (a2[1] & 0x10) != 0 )
      IoPerfReset(1ui64);
    v11 = a2[4];
    if( (v11 & 0x400000) != 0 )
    {
      qword_140C00EB8 = 0i64;
      v11 = a2[4];
    }
    if( (v11 & 0x80000) != 0 )
    {
      qword_140C00EC0 = 0i64;
      v11 = a2[4];
    }
    if( (v11 & 0x100000) != 0 )
    {
      qword_140C00EC8 = 0i64;
      v11 = a2[4];
    }
    if( (v11 & 0x200000) != 0 )
    {
      qword_140C00ED0 = 0i64;
      v11 = a2[4];
    }
    if( (v11 & 0x1000000) != 0 )
    {
      qword_140C11ED0 = 0i64;
      v11 = a2[4];
    }
    if( (v11 & 0x2000000) != 0 )
      qword_140C11ED8 = 0i64;
    if( (a2[2] & 0x8000000) != 0 )
      qword_140C11EE0 = 0i64;
    if( (*a2 & 0x40000) != 0 )
      DbgSetDebugPrintCallback(EtwpTraceDebugPrint, 0);
    v12 = a2[1];
    if( (v12 & 2) != 0 )
    {
      KeStopProfile((_KPROFILE *)&ExBootDevicesRemovedEvent + 528);
      v12 = a2[1];
    }
    if( (v12 & 0x400) != 0 )
    {
      for( i = 0; i < *(&ExBootDevicesRemovedEvent + 648); ++i )
        KeStopProfile((_KPROFILE *)(*(&ExBootDevicesRemovedEvent + 325) + 248i64 * i));
    }
    if( (a2[4] & 0x80u) != 0 )
    {
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --CurrentThread->Tcb.SpecialApcDisable;
      ExAcquirePushLockExclusiveEx(&stru_140C25A40, 0i64);
      ObpTraceFlags &= ~4u;
      if( (_InterlockedExchangeAdd64(&stru_140C25A40._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock(&stru_140C25A40);
      KeAbPostRelease(&stru_140C25A40);
      KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
    }
    if( (a2[1] & 0x880000) != 0 && (!a1 || (a1[1] & 0x880000) == 0) )
      KeCancelTimer2((INT64)&ExBootDevicesRemovedEvent + 2880);
  }
  LODWORD(TraceClassa) = v4;
  return EtwpUpdateFileInfoDriverState(a1, a2, 0, a3, TraceClassa);
}

Referenced by: