SendCaptureStateNotificationsWorker

VOID __fastcall SendCaptureStateNotificationsWorker(INT64 a1){
  __int64 v2; 
  volatile INT64 *v3; 
  unsigned int v4; 
  _GUID *PoolWithTag; 
  _GUID *v6; 
  _ETW_GUID_ENTRY *GuidEntryByGuid; 
  _ETW_GUID_ENTRY *v8; 
  _ETHREAD *CurrentThread; 
  _LIST_ENTRY *Flink; 
  int v11; 
  unsigned __int16 *p_LoggerId; 
  __int64 v13; 
  unsigned __int8 v14; 
  _ETWP_NOTIFICATION_HEADER *DataBlock; 
  __int64 v16; 
  _GUID *Guid; 
  __int64 v18; 
  _OWORD v19[4]; 
  _TRACE_ENABLE_INFO EnableInfo; 
  INT64 v21[2]; 
  DataBlock = 0i64;
  *(_OWORD *)v21 = 0i64;
  memset((INT64)v19 + 8, 0i64);
  v3 = (volatile INT64 *)(a1 + 704);
  v18 = *(_QWORD *)(a1 + 1064);
  v2 = v18;
  ExAcquirePushLockExclusiveEx(a1 + 704, 0i64);
  *(_DWORD *)(v18 + 64) = 0;
  if( !*(_DWORD *)(a1 + 336)
    || (v4 = *(unsigned __int16 *)(v2 + 16), !(_WORD)v4)
    || (v16 = *(unsigned __int16 *)(v2 + 16),
        PoolWithTag = (_GUID *)ExAllocatePoolWithTag(PagedPool, 16i64 * v4, 0x74777445ui64),
        (Guid = PoolWithTag) == 0i64) )
  {
LABEL_24:
    if( (_InterlockedExchangeAdd64(v3, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(v3);
    KeAbPostRelease((PVOID)v3);
    goto LABEL_27;
  }
  memmove((UINT8 *)PoolWithTag, *(UINT8 **)(v2 + 24), 16i64 * v4);
  if( (_InterlockedExchangeAdd64(v3, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock((volatile INT64 *)(a1 + 704));
  KeAbPostRelease((PVOID)(a1 + 704));
  *(_QWORD *)&v19[0] = 0x7800000003i64;
  v6 = Guid;
  do
  {
    GuidEntryByGuid = EtwpFindGuidEntryByGuid(*(_ETW_SILODRIVERSTATE **)(a1 + 1080), v6, EtwTraceGuidType);
    v8 = GuidEntryByGuid;
    if( GuidEntryByGuid )
    {
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --*((_WORD *)CurrentThread + 242);
      ExAcquirePushLockExclusiveEx((UINT64)&GuidEntryByGuid->Lock, 0i64);
      Flink = v8->RegListHead.Flink;
      v8->LockOwner = (_ETHREAD *)KeGetCurrentThread();
      for( *(_GUID *)((char *)&v19[2] + 8) = *v6; Flink != &v8->RegListHead; Flink = Flink->Flink )
      {
        if( (BYTE2(Flink[6].Flink) & 1) == 0 )
        {
          v11 = 0;
          p_LoggerId = &v8->EnableInfo[0].LoggerId;
          do
          {
            v14 = BYTE4(Flink[6].Flink);
            if( ((unsigned __int8)(1 << v11) & v14) != 0 )
            {
              if( *(_DWORD *)(p_LoggerId - 3) )
              {
                if( *p_LoggerId == *(_DWORD *)a1 )
                {
                  EtwpComputeRegEntryEnableInfo((_ETW_REG_ENTRY *)Flink, &EnableInfo);
                  EnableInfo.LoggerId = *(_WORD *)a1;
                  EnableInfo.IsEnabled = 2;
                  if( (int)EtwpBuildNotificationPacket((__int64)v8, v19, v14, (__int64 *)&DataBlock) >= 0 )
                  {
                    EtwpSendDataBlock((_ETW_REG_ENTRY *)Flink, DataBlock);
                    EtwpUnreferenceDataBlock((volatile INT32 *)DataBlock);
                  }
                }
              }
            }
            ++v11;
            p_LoggerId += 16;
          }
          while( v11 < 8 );
        }
      }
      v8->LockOwner = 0i64;
      ExReleasePushLockEx((UINT64)&v8->Lock, 0i64);
      KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
      EtwpUnreferenceGuidEntry(v8);
    }
    ++v6;
    --v16;
  }
  while( v16 );
  v13 = v18;
  v3 = (volatile INT64 *)(a1 + 704);
  if( *(_DWORD *)(a1 + 336) )
  {
    v21[1] = -1i64;
    ExAcquirePushLockExclusiveEx((UINT64)v3, 0i64);
    if( *(_WORD *)(v13 + 16) && !*(_DWORD *)(v13 + 64) )
    {
      ExSetTimer(*(_QWORD *)(v13 + 8), *(_QWORD *)v13, 0i64, (INT64)v21);
      *(_DWORD *)(v13 + 64) = 1;
    }
    goto LABEL_24;
  }
LABEL_27:
  EtwpReleaseLoggerContext((unsigned int *)a1, 0);
}

Referenced by: