EtwpKsrCallback

VOID __stdcall EtwpKsrCallback(PVOID CallbackContext, PVOID Argument1, PVOID Argument2){
  int v3; 
  bool v4; 
  unsigned int v5; 
  _ETW_SILODRIVERSTATE *i; 
  _WMI_LOGGER_CONTEXT *v7; 
  _WMI_LOGGER_CONTEXT *v8; 
  __int64 v9; 
  char v10; 
  v3 = (int)Argument1;
  if( !(_DWORD)Argument1 )
  {
LABEL_8:
    EtwpSavePersistedLoggers();
    goto LABEL_9;
  }
  if( (_DWORD)Argument1 != 1 )
  {
    if( (_DWORD)Argument1 == 2 )
    {
      EtwpSavePersistedLoggers();
      return;
    }
    if( (_DWORD)Argument1 != 3 )
    {
      if( (_DWORD)Argument1 != 4 )
        return;
      goto LABEL_9;
    }
    goto LABEL_8;
  }
LABEL_9:
  v4 = !v3 || v3 == 3;
  EtwpKsrPrepared = v4;
  v5 = 0;
  for( i = (_ETW_SILODRIVERSTATE *)EtwpHostSiloState; v5 < *(_DWORD *)(EtwpHostSiloState + 16); ++v5 )
  {
    v7 = EtwpAcquireLoggerContextByLoggerId(i, v5, 0);
    v8 = v7;
    if( v7 )
    {
      v9 = *((_QWORD *)v7 + 134);
      v10 = 0;
      if( v9 )
      {
        v10 = 1;
        KeWaitForSingleObject((char *)v7 + 648, Executive, 0, 0, 0i64);
        if( !v3 || v3 == 3 )
        {
          if( *(_BYTE *)(v9 + 32) )
            EtwpPreserveLogger((INT64)v8);
        }
        else
        {
          EtwpCancelMemoryPreservation(v8);
        }
      }
      EtwpReleaseLoggerContext((unsigned int *)v8, v10);
    }
    i = (_ETW_SILODRIVERSTATE *)EtwpHostSiloState;
  }
}

Referenced by: