SmKmStoreTerminateWorker

VOID __stdcall SmKmStoreTerminateWorker(PVOID Parameter){
  int v2; 
  unsigned int v3; 
  int v4; 
  struct _EX_RUNDOWN_REF *v5; 
  int v6; 
  EVENT_DATA_DESCRIPTOR *UserData; 
  UINT64 *v8; 
  INT64 v9; 
  struct _EX_RUNDOWN_REF *v10; 
  UINT64 Size; 
  __int64 v12; 
  __int64 v13; 
  INT64 *v14; 
  UINT64 UserDataCount; 
  INT64 a1[2]; 
  int v17; 
  int v18; 
  int v19; 
  int v20; 
  int v21; 
  INT64 *v22; 
  int v23; 
  int v24; 
  _DWORD v25[20]; 
  INT64 result[2]; 
  unsigned int v27; 
  int v28[276]; 
  EVENT_DATA_DESCRIPTOR v29; 
  __int64 v30; 
  __int64 v31; 
  memset((INT64)result, 0i64);
  memset((INT64)&v29, 0i64);
  memset((INT64)v25, 0i64);
  v25[0] = 1;
  if( (int)ZwQuerySystemInformation() >= 0
    && (memset((INT64)result + 4, 0i64), v2 = 0, LODWORD(result[0]) = 259, (v25[0] & 0xFF00) != 0) )
  {
    while( 1 )
    {
      HIDWORD(result[0]) = v25[v2 + 1];
      if( (int)ZwQuerySystemInformation() >= 0 )
      {
        v3 = 0;
        if( v27 )
          break;
      }
LABEL_9:
      if( ++v2 >= (unsigned int)BYTE1(v25[0]) )
        goto LABEL_10;
    }
    v4 = v28[16];
    while( !_bittest(&v4, v3) != *((_DWORD *)Parameter + 13) || v28[v3] != *((_DWORD *)Parameter + 12) )
    {
      if( ++v3 >= v27 )
        goto LABEL_9;
    }
    v6 = 0;
    UserData = &v29;
    a1[1] = (INT64)result;
    a1[0] = (INT64)&v29;
    v18 = 6;
    v20 = 1036;
    v8 = SmEtwEnabled(2i64);
    if( v8 )
    {
      if( Parameter != (PVOID)-56i64 )
        LOBYTE(result[0]) = *((_BYTE *)Parameter + 56);
      v29.Ptr = (unsigned __int64)result;
      *(_QWORD *)&v29.Size = 1i64;
      if( Parameter != (PVOID)-60i64 )
        *(_DWORD *)((char *)result + 1) = *((_DWORD *)Parameter + 15);
      v30 = (__int64)result + 1;
      v31 = 4i64;
      v9 = *((_QWORD *)Parameter + 5);
      v17 = 2;
      v19 = 5;
      SmKmEtwAppendProductName((INT64)a1, v9);
      SmKmEtwAppendObjectName((INT64)a1, *(_QWORD *)(v9 + 8));
      v6 = v17;
      UserData = (EVENT_DATA_DESCRIPTOR *)a1[0];
    }
    v10 = (struct _EX_RUNDOWN_REF *)SmKmStoreRefFromStoreIndex(
                                      *((_QWORD *)Parameter + 4),
                                      *((_DWORD *)Parameter + 12) & 0x3FF);
    ExReleaseRundownProtection(v10 + 1);
    if( (int)ZwSetSystemInformation() >= 0 )
    {
      if( v8 )
      {
        LODWORD(UserDataCount) = v6;
        EtwWriteEx(*v8, (EVENT_DESCRIPTOR *)&SmEventCacheTermination, 0i64, 0i64, 0i64, 0i64, UserDataCount, UserData);
        if( !*((_DWORD *)Parameter + 14) )
        {
          Size = UserData[3].Size;
          memmove((UINT8 *)result, (UINT8 *)UserData[3].Ptr, Size);
          v21 = 2;
          v14 = result;
          v23 = 1;
          *((_WORD *)result + (Size >> 1)) = 0;
          if( !LOWORD(result[0]) )
            v14 = (INT64 *)L"(null)";
          v22 = v14;
          v24 = *((_DWORD *)Parameter + 15);
          SmKmSqmAddToStream(*v8, v12, v13, &v21);
        }
      }
    }
  }
  else
  {
LABEL_10:
    v5 = (struct _EX_RUNDOWN_REF *)SmKmStoreRefFromStoreIndex(
                                     *((_QWORD *)Parameter + 4),
                                     *((_DWORD *)Parameter + 12) & 0x3FF);
    ExReleaseRundownProtection(v5 + 1);
  }
  ExFreePoolWithTag(Parameter, 0);
}

Referenced by: