EtwpUpdateGroupMasks

INT64 __fastcall EtwpUpdateGroupMasks(INT64 a1, INT64 a2){
  unsigned int v2; 
  UINT64 v4; 
  int v6; 
  __int64 v7; 
  __int64 v8; 
  int v9; 
  int v10; 
  int v11; 
  int updated; 
  __int64 v13; 
  char *v14; 
  __int16 v15; 
  INT64 v16; 
  int *v17; 
  char *v18; 
  __int64 v19; 
  int v20; 
  int v21; 
  char v22; 
  __int64 v23; 
  char v24; 
  INT64 result; 
  int v26; 
  unsigned int a3; 
  _PERFINFO_GROUPMASK GroupMasks; 
  _PERFINFO_GROUPMASK v29; 
  v2 = *(_DWORD *)a1;
  v4 = *(_QWORD *)(a1 + 1080);
  memset(&GroupMasks, 0, sizeof(GroupMasks));
  memset(&v29, 0, sizeof(v29));
  EtwpMapEnableFlags((_PERFINFO_GROUPMASK *)a2, 1u);
  if( a2 )
  {
    v6 = *(_DWORD *)(a2 + 4);
    if( (v6 & 1) != 0 || (v6 & 0x10) != 0 )
      *(_DWORD *)a2 |= 0x200u;
  }
  if( *(_QWORD *)(a1 + 1080) == EtwpHostSiloState || (result = EtwpCheckSiloGroupMasks((CHAR *)a2), (int)result >= 0) )
  {
    if( a2
      && (*(_DWORD *)(a2 + 4) & 0x402) != 0
      && !SeSinglePrivilegeCheck(*(_QWORD *)&SeSystemProfilePrivilege, *((_BYTE *)KeGetCurrentThread() + 562)) )
    {
      return 3221225569i64;
    }
    ExAcquirePushLockExclusiveEx(a1 + 704, 0i64);
    v7 = 32i64 * *(unsigned __int8 *)(a1 + 834);
    a3 = *(unsigned __int8 *)(a1 + 834);
    v8 = v7 + *(_QWORD *)(a1 + 1080) + 4260i64;
    if( !v8
      || (v9 = *(_DWORD *)(v8 + 4), (v9 & 4) == 0)
      || (v9 & 0x100) == 0
      || a2 && (v26 = *(_DWORD *)(a2 + 4), (v26 & 4) != 0) && (v26 & 0x100) != 0 )
    {
      if( a2 )
      {
        v10 = *(_DWORD *)(a2 + 4);
        if( (v10 & 4) != 0 && (v10 & 0x100) != 0 )
        {
          if( !v8 || (v11 = *(_DWORD *)(v8 + 4), (v11 & 4) == 0) || (v11 & 0x100) == 0 )
          {
            updated = EtwpCCSwapStart(*(unsigned int *)(a1 + 216));
            if( updated < 0 )
            {
LABEL_23:
              v24 = _InterlockedExchangeAdd64((volatile signed __int64 *)(a1 + 704), 0xFFFFFFFFFFFFFFFFui64);
              if( (v24 & 2) != 0 && (v24 & 4) == 0 )
                ExfTryToWakePushLock((volatile INT64 *)(a1 + 704));
              KeAbPostRelease((PVOID)(a1 + 704));
              return(unsigned int)updated;
            }
          }
        }
      }
    }
    else
    {
      EtwpCCSwapStop(*(unsigned int *)(a1 + 216), 1u);
    }
    v13 = *(_QWORD *)(a1 + 1080);
    v14 = (char *)&GroupMasks - v7 - v13;
    v15 = v13 + v7;
    v16 = a2 - v7 - v13;
    v17 = (int *)(v13 + v7 + 4260);
    v18 = (char *)&v29 - v7 - v13;
    v19 = 8i64;
    do
    {
      v20 = *(int *)((char *)v17 + v16 - 4260);
      *(int *)((char *)v17 + (_QWORD)v14 - 4260) = *v17 & ~v20;
      v21 = *v17++;
      *(int *)((char *)v17 + (_QWORD)v18 - 4264) = v20 & ~v21;
      --v19;
    }
    while( v19 );
    EtwpLogGroupMask(v4, (_PERFINFO_GROUPMASK *)v2, v15 + 4260);
    if( (*(_DWORD *)(a1 + 12) & 0x400) != 0 )
    {
      v22 = 1;
    }
    else
    {
      v22 = 0;
      EtwpKernelTraceRundown(&GroupMasks, v4, v2);
    }
    v23 = *(_QWORD *)(a1 + 1080);
    *(_OWORD *)(v23 + v7 + 4260) = *(_OWORD *)a2;
    *(_OWORD *)(v23 + v7 + 4276) = *(_OWORD *)(a2 + 16);
    updated = EtwpUpdateGlobalGroupMasks(v4, v2, a3);
    if( updated >= 0 )
    {
      EtwpLogGroupMask(v4, (_PERFINFO_GROUPMASK *)v2, a2);
      if( !v22 || (*(_DWORD *)(a1 + 832) & 2) != 0 )
        EtwpKernelTraceRundown(&v29, v4, v2);
    }
    EtwpLogAlwaysPresentRundown(v4);
    goto LABEL_23;
  }
  return result;
}

Referenced by: