EtwpTrackGuidEntryRegistrations

INT64 __fastcall EtwpTrackGuidEntryRegistrations(_DWORD *a1, INT64 a2, CHAR a3){
  _ETHREAD *CurrentThread; 
  UINT64 v7; 
  INT64 v8; 
  unsigned int v9; 
  _ETW_REG_ENTRY *i; 
  _ETHREAD *v11; 
  _ETW_REG_ENTRY *v12; 
  __int64 Process; 
  _EJOB *ProcessServerSilo; 
  _EJOB *v15; 
  _KAPC_STATE ApcState; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  v7 = a2 + 408;
  ExAcquirePushLockExclusiveEx(a2 + 408, 0i64);
  v8 = a2 + 128;
  *(_QWORD *)(a2 + 416) = KeGetCurrentThread();
  v9 = 0;
  while( !*(_DWORD *)v8 || *(unsigned __int16 *)(v8 + 6) != *a1 )
  {
    ++v9;
    v8 += 32i64;
    if( v9 >= 8 )
      goto LABEL_18;
  }
  for( i = *(_ETW_REG_ENTRY **)(a2 + 56); i != (_ETW_REG_ENTRY *)(a2 + 56); i = (_ETW_REG_ENTRY *)i->RegList.Flink )
  {
    if( a3 == 2 )
    {
      v11 = (_ETHREAD *)KeGetCurrentThread();
      v12 = (_ETW_REG_ENTRY *)((char *)i - 16);
      --*((_WORD *)v11 + 242);
      ExAcquirePushLockExclusiveEx((UINT64)&i->GroupRegList.Flink[25].Blink, 0i64);
      i->GroupRegList.Flink[26].Flink = (_LIST_ENTRY *)KeGetCurrentThread();
    }
    else
    {
      v12 = i;
    }
    if( (v12->Flags & 1) != 0 )
    {
      EtwpProviderArrivalCallback((_WMI_LOGGER_CONTEXT *)a1, 0, v12);
    }
    else if( ExAcquireRundownProtection((PEX_RUNDOWN_REF)v12->Process + 139) )
    {
      Process = (__int64)v12->Process;
      memset(&ApcState, 0, sizeof(ApcState));
      ProcessServerSilo = (_EJOB *)PsGetProcessServerSilo(Process);
      v15 = PsAttachSiloToCurrentThread(ProcessServerSilo);
      KiStackAttachProcess((_KPROCESS *)v12->Process, 0i64, &ApcState);
      EtwpProviderArrivalCallback((_WMI_LOGGER_CONTEXT *)a1, 1, v12);
      KiUnstackDetachProcess(&ApcState, 0i64);
      PsDetachSiloFromCurrentThread(v15);
      ExReleaseRundownProtection((PEX_RUNDOWN_REF)v12->Process + 139);
    }
    if( a3 == 2 )
    {
      v12->GuidEntry->LockOwner = 0i64;
      ExReleasePushLockEx((UINT64)&v12->GuidEntry->Lock, 0i64);
      KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
    }
  }
LABEL_18:
  *(_QWORD *)(a2 + 416) = 0i64;
  ExReleasePushLockEx(v7, 0i64);
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  return 0i64;
}

Referenced by: