EtwpUpdatePerProcessTracing

VOID __stdcall EtwpUpdatePerProcessTracing(
        _WMI_LOGGER_INFORMATION *LoggerInfo,
        UINT64 LoggerId,
        UINT64 UmglIndex,
        UINT64 a4){
  __int64 v4; 
  char v5; 
  _TRACE_ENABLE_FLAG_EXT_ITEM *FlagExtension; 
  _TRACE_ENABLE_FLAG_EXT_ITEM *v9; 
  unsigned __int16 v10; 
  unsigned int v11; 
  __int64 v12; 
  _EPROCESS *Process; 
  __int64 Context; 
  __int16 v15; 

  v4 = (unsigned int)a4;
  v5 = UmglIndex;
  Context = 0i64;
  Process = 0i64;
  v15 = 0;
  KeWaitForSingleObject((UINT64)&ExBootDevicesRemovedEvent + 1376, 0, 0, 0, 0i64);
  FlagExtension = EtwpGetFlagExtension(LoggerInfo, 2u);
  if( FlagExtension )
  {
    v9 = FlagExtension + 1;
    LODWORD(Context) = v4;
    v10 = 4 * FlagExtension->Offset - 4;
    BYTE4(Context) = 1;
    v11 = v10 >> 2;
    if( v11 )
    {
      v12 = v11;
      do
      {
        if( PsLookupProcessByProcessId((VOID *)*(_DWORD *)v9, &Process) >= 0 )
        {
          EtwpUpdateProcessTracingCallback((ULONG_PTR)Process, &Context);
          ObfDereferenceObjectWithTag(Process, 0x746C6644ui64);
        }
        ++v9;
        --v12;
      }
      while( v12 );
    }
  }
  LOBYTE(v15) = v5;
  if( LoggerId == EtwpHostSiloState )
    *(_WORD *)(2 * v4 - 0x87FFFFFFC80i64) = v15;
  else
    *(_WORD *)(*(_QWORD *)(*(_QWORD *)(LoggerId + 8) + 1128i64) + 2 * v4 + 550) = v15;
  KeReleaseMutex((_KMUTANT *)((char *)&ExBootDevicesRemovedEvent + 1376), 0);
}

Referenced by: