EtwpCovSampCaptureContextStop

VOID __fastcall EtwpCovSampCaptureContextStop(union SLIST_HEADER *a1){
  UINT64 v1; 
  _ETHREAD *CurrentThread; 
  UINT64 *v4; 
  UINT8 v5; 
  unsigned __int8 v6; 
  unsigned __int64 v7; 
  char *v8; 
  UINT64 i; 
  union _LARGE_INTEGER v10; 
  void *v11; 
  void *v12; 
  IRP *Timeout; 
  union _LARGE_INTEGER v14; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  v4 = (UINT64 *)((char *)a1 + 264);
  KeAcquireSpinLockRaiseToDpc((UINT64 *)a1 + 33, v1);
  *((_DWORD *)a1 + 228) = 0;
  v7 = v6;
  if( *((_DWORD *)a1 + 229) )
    *((_DWORD *)a1 + 229) = 0;
  v8 = (char *)a1 + 576;
  for( i = *((_QWORD *)a1 + 72); (char *)i != v8; i = *(_QWORD *)i )
  {
    *(_DWORD *)(i + 24) = 0;
    *(_DWORD *)(i + 28) = 0;
  }
  KeResetEvent((char *)a1 + 888, i, (UINT8)v8, v5, Timeout);
  *((_DWORD *)a1 + 230) = 0;
  KxReleaseSpinLock(v4);
  __writecr8(v7);
  EtwpCovSampCaptureFlushSampleBuffers((INT64)a1);
  EtwpCovSampCaptureCleanupLookasides((INT64)a1);
  v10.QuadPart = -2500000i64;
  for( v14.QuadPart = -2500000i64; KeWaitForSingleObject((char *)a1 + 888, Executive, 0, 0, &v14); v14 = v10 )
  {
    EtwpCovSampCaptureCancelApcs((INT64)a1);
    EtwpCovSampCaptureFlushSampleBuffers((INT64)a1);
    v10.QuadPart *= 2i64;
    if( v10.QuadPart < -9600000000i64 )
      v10.QuadPart = -9600000000i64;
  }
  EtwpCovSampCaptureFreeLookasides(a1);
  v11 = (void *)*((_QWORD *)a1 + 119);
  if( v11 )
  {
    ExFreePoolWithTag(v11, 0x56777445u);
    *((_QWORD *)a1 + 119) = 0i64;
  }
  v12 = (void *)*((_QWORD *)a1 + 120);
  if( v12 )
  {
    ExFreePoolWithTag(v12, 0x56777445u);
    *((_QWORD *)a1 + 120) = 0i64;
  }
  *((_QWORD *)a1 + 118) = 0i64;
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
}

Referenced by: