EtwpUpdatePerProcessTracing

LONG __fastcall EtwpUpdatePerProcessTracing(__int64 a1, __int64 a2, char a3, unsigned int a4){
  __int64 v4; 
  unsigned __int16 *FlagExtension; 
  unsigned int *v9; 
  unsigned __int16 v10; 
  unsigned int v11; 
  __int64 v12; 
  _EPROCESS *Process; 
  __int64 Context; 
  __int16 v16; 
  v4 = a4;
  Context = 0i64;
  Process = 0i64;
  v16 = 0;
  KeWaitForSingleObject(&EtwpGlobalMutex, Executive, 0, 0, 0i64);
  FlagExtension = EtwpGetFlagExtension(a1, 2);
  if( FlagExtension )
  {
    v9 = (unsigned int *)(FlagExtension + 2);
    LODWORD(Context) = v4;
    v10 = 4 * *FlagExtension - 4;
    BYTE4(Context) = 1;
    v11 = v10 >> 2;
    if( v11 )
    {
      v12 = v11;
      do
      {
        if( PsLookupProcessByProcessId((HANDLE)*v9, (PEPROCESS *)&Process) >= 0 )
        {
          EtwpUpdateProcessTracingCallback(Process, &Context);
          ObfDereferenceObjectWithTag(Process, 0x746C6644ui64);
        }
        ++v9;
        --v12;
      }
      while( v12 );
    }
  }
  LOBYTE(v16) = a3;
  if( a2 == EtwpHostSiloState )
    *(_WORD *)(2 * v4 - 0x87FFFFFFC80i64) = v16;
  else
    *(_WORD *)(*(_QWORD *)(*(_QWORD *)(a2 + 8) + 1128i64) + 2 * v4 + 550) = v16;
  return KeReleaseMutex(&EtwpGlobalMutex, 0);
}

Referenced by: