PerfLogImageUnload

VOID __stdcall PerfLogImageUnload(
        _UNICODE_STRING *ImageName,
        _FILE_OBJECT *FileObject,
        PVOID ProcessId,
        PVOID ImageBase,
        UINT64 ImageSize,
        UINT64 ImageChecksum,
        UINT64 ImageSignatureLevel,
        UINT64 ImageSignatureType,
        UINT64 LocksHeld){
  INT64 v13; 
  unsigned int TimeDateStamp; 
  IMAGE_NT_HEADERS *v15; 
  _QWORD *PoolWithTag; 
  __int64 v17; 
  int v18; 
  _UNICODE_STRING *v19; 
  INT64 v20; 
  INT64 v21; 
  INT64 v22; 
  unsigned int v23; 
  INT64 v24; 
  __int64 v25; 
  __int128 v26[5]; 
  v13 = 0i64;
  v24 = 0i64;
  v26[0] = 0i64;
  v25 = 0i64;
  TimeDateStamp = 0;
  v23 = 0;
  if( EtwpHostSiloState != -4548 && (*(_DWORD *)(EtwpHostSiloState + 4548) & 4) != 0 )
    EtwpCoverageSamplerUnloadImage((INT64)ProcessId, (UINT64)ImageBase, ImageSize);
  if( ProcessId )
  {
    v15 = RtlImageNtHeader(ImageBase);
    if( v15 )
    {
      LODWORD(ImageChecksum) = v15->OptionalHeader.CheckSum;
      TimeDateStamp = v15->FileHeader.TimeDateStamp;
      v23 = TimeDateStamp;
      v13 = v15->OptionalHeader.ImageBase;
      v24 = v13;
    }
  }
  if( FileObject )
  {
    if( (_DWORD)LocksHeld || KeAreAllApcsDisabled() )
    {
      PoolWithTag = ExAllocatePoolWithTag(NonPagedPoolNx, 0x90ui64, 0x41777445ui64);
      if( PoolWithTag )
      {
        ObfReferenceObject(FileObject);
        PoolWithTag[11] = FileObject;
        PoolWithTag[12] = ProcessId;
        PoolWithTag[13] = ImageBase;
        PoolWithTag[14] = ImageSize;
        *((_DWORD *)PoolWithTag + 30) = ImageChecksum;
        *((_DWORD *)PoolWithTag + 31) = TimeDateStamp;
        *((_DWORD *)PoolWithTag + 32) = ImageSignatureLevel;
        *((_DWORD *)PoolWithTag + 33) = ImageSignatureType;
        PoolWithTag[17] = v13;
        KeInitializeApc(
          (INT64)PoolWithTag,
          (INT64)KeGetCurrentThread(),
          0i64,
          (INT64)xHalTimerWatchdogStop,
          (INT64)EtwpCancelTraceImageUnloadApc,
          (INT64)EtwpTraceImageUnloadApc,
          0,
          (INT64)PoolWithTag);
        if( KeInsertQueueApc((_KAPC *)PoolWithTag, 0i64, 0i64, 0i64) )
          return;
        ExFreePoolWithTag(PoolWithTag, 0);
        HalPutDmaAdapter((PADAPTER_OBJECT)FileObject);
        v13 = v24;
        TimeDateStamp = v23;
      }
      v17 = 512i64;
    }
    else
    {
      v17 = 1024i64;
    }
    if( FltMgrCallbacks )
    {
      v18 = (*(__int64(__fastcall **)(_FILE_OBJECT *, __int64, __int128 *, __int64 *))(FltMgrCallbacks + 24))(
              FileObject,
              v17,
              v26,
              &v25);
      v19 = (_UNICODE_STRING *)v26;
      if( v18 < 0 )
        v19 = ImageName;
      ImageName = v19;
    }
  }
  LODWORD(v22) = LocksHeld;
  LODWORD(v21) = TimeDateStamp;
  LODWORD(v20) = ImageChecksum;
  EtwpTraceImageUnload(
    (INT64)ImageName,
    (INT64)ProcessId,
    (INT64)ImageBase,
    ImageSize,
    v20,
    v21,
    ImageSignatureLevel,
    ImageSignatureType,
    v13,
    v22);
  if( v25 )
    (*(void(**)(void))(FltMgrCallbacks + 32))();
}

Referenced by: