EmonDisableMonitoring

NTSTATUS __stdcall EmonDisableMonitoring(INT64 a1, UINT64 *a2){
  NTSTATUS result; 
  _QWORD *v3; 
  unsigned int i; 
  __int64 v5; 
  __int64 v6; 

  result = *(&CmpDummyThreadEvent + 1217) * KeGetPcr()->Prcb.Number;
  v3 = (_QWORD *)(*(&CmpDummyThreadEvent + 620) + 16i64 * (unsigned int)result);
  if( a2 )
  {
    i = *(_DWORD *)a2;
    if( (*(_DWORD *)a2 & 0x40000000) != 0 )
      i = *(&CmpDummyThreadEvent + 1223) + (i & 0xBFFFFFFF);
LABEL_8:
    EmonConfigureCounter(i, 0, 0i64, 0i64, 0);
    v5 = *(&CmpDummyThreadEvent + 620) + 16i64 * *(&CmpDummyThreadEvent + 1217) * KeGetPcr()->Prcb.Number;
    v6 = 2i64 * i;
    *(_DWORD *)(v5 + 8 * v6 + 4) = 0;
    *(_DWORD *)(v5 + 8 * v6) = 3;
    return _InterlockedExchangeAdd((_DWORD *)&stru_140CF2E80 + 1614, 0xFFFFFFFE);
  }
  for( i = 0; i < *(&CmpDummyThreadEvent + 1217); v3 += 2 )
  {
    if( *v3 == __PAIR64__(a1, 0) )
      break;
    ++i;
  }
  if( i != *(&CmpDummyThreadEvent + 1217) )
    goto LABEL_8;
  return result;
}

Referenced by: