EtwpFindGuidEntryByGuid

_ETW_GUID_ENTRY *__stdcall EtwpFindGuidEntryByGuid(
        _ETW_SILODRIVERSTATE *SiloState,
        const _GUID *Guid,
        _ETW_GUID_TYPE GuidType){
  _ETW_GUID_ENTRY *v4; 
  _ETW_HASH_BUCKET *v5; 
  _ETHREAD *CurrentThread; 
  _LIST_ENTRY *v7; 
  _EX_PUSH_LOCK *p_BucketLock; 
  _ETW_GUID_ENTRY *Flink; 
  __int64 v10; 

  v4 = 0i64;
  v5 = &SiloState->EtwpGuidHashTable[((unsigned __int8)Guid->Data1 ^ (unsigned __int8)(*(_DWORD *)&Guid->Data2 ^ *(_DWORD *)Guid->Data4 ^ *(_DWORD *)&Guid->Data4[4])) & 0x3F];
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v7 = &v5->ListHead[GuidType];
  --CurrentThread->Tcb.KernelApcDisable;
  p_BucketLock = &v5->BucketLock;
  ExAcquirePushLockSharedEx(&v5->BucketLock, 0i64);
  Flink = (_ETW_GUID_ENTRY *)v7->Flink;
  if( v7->Flink != v7 )
  {
    while( 1 )
    {
      v10 = *(_QWORD *)&Guid->Data1 - *(_QWORD *)&Flink->Guid.Data1;
      if( *(_QWORD *)&Guid->Data1 == *(_QWORD *)&Flink->Guid.Data1 )
        v10 = *(_QWORD *)Guid->Data4 - *(_QWORD *)Flink->Guid.Data4;
      if( !v10 && EtwpReferenceGuidEntry(Flink) )
        break;
      Flink = (_ETW_GUID_ENTRY *)Flink->GuidList.Flink;
      if( Flink == (_ETW_GUID_ENTRY *)v7 )
        goto LABEL_9;
    }
    v4 = Flink;
  }
LABEL_9:
  if( _InterlockedCompareExchange64(&p_BucketLock->_bf_0, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared(p_BucketLock);
  KeAbPostRelease(p_BucketLock);
  KeLeaveCriticalRegion();
  return v4;
}

Referenced by: