EtwShutdown

VOID __stdcall EtwShutdown(UINT8 HiberBoot){
  __int64 v2; 
  bool IsCurrentThreadInServerSilo; 
  bool v4; 
  __int16 v5; 
  _WMI_LOGGER_CONTEXT *v6; 
  INT64 result; 
  __int16 v8; 
  __int128 v9; 
  int v10; 
  v2 = PsGetCurrentServerSiloGlobals()[108];
  IsCurrentThreadInServerSilo = PsIsCurrentThreadInServerSilo();
  v4 = IsCurrentThreadInServerSilo;
  if( !HiberBoot )
  {
    if( !IsCurrentThreadInServerSilo )
      EtwpTraceSystemShutdown();
    *(_DWORD *)(v2 + 4068) = 1;
  }
  if( !v4 )
    EtwpFlushCoverage();
  memset((INT64)&result, 0i64);
  LODWORD(result) = 176;
  v5 = *(_WORD *)(v2 + 16);
  v10 = 0x20000;
  while( --v5 >= 0 )
  {
    v6 = EtwpAcquireLoggerContextByLoggerId((_ETW_SILODRIVERSTATE *)v2, (unsigned int)v5, 0);
    if( v6 )
    {
      if( v4 )
        goto LABEL_19;
      if( HiberBoot )
      {
        if( (*((_DWORD *)v6 + 3) & 0x400000) == 0 )
          goto LABEL_8;
LABEL_19:
        if( v5 )
          v8 = v5;
        else
          v8 = -1;
        v9 = *(_OWORD *)((char *)v6 + 292);
        EtwpReleaseLoggerContext((unsigned int *)v6, 0);
        if( !HiberBoot )
          ++EtwpStopTraceCount;
        EtwpStopTrace(v2, &result, 1);
      }
      else
      {
        if( (*((_DWORD *)v6 + 3) & 0x400) == 0 )
          goto LABEL_19;
LABEL_8:
        EtwpReleaseLoggerContext((unsigned int *)v6, 0);
      }
    }
  }
  if( !HiberBoot )
    EtwpStopTraceCount = 0;
}

Referenced by: