EtwpCoverageSamplerUnloadImage

VOID __stdcall EtwpCoverageSamplerUnloadImage(INT64 a1, UINT64 a2, INT64 a3){
  _EX_PUSH_LOCK *v6; 
  _ETHREAD *CurrentThread; 
  _LIST_ENTRY *v8; 

  v8 = 0i64;
  if( (int)EtwpCovSampAcquireSamplerRundown(&v8) < 0 )
    goto LABEL_8;
  if( a2 < 0xFFFF800000000000ui64 )
  {
    v6 = *(_EX_PUSH_LOCK **)(a1 + 2544);
    if( !v6 )
      goto LABEL_8;
  }
  else
  {
    v6 = (_EX_PUSH_LOCK *)(*(&ExBootDevicesRemovedEvent + 151) + 752i64);
  }
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  ExAcquirePushLockExclusiveEx(v6 + 1, 0i64);
  v6[2]._bf_0 = (__int64)KeGetCurrentThread();
  EtwpCovSampProcessRemoveModule((INT64)v6, a2, a3);
  v6[2]._bf_0 = 0i64;
  if( (_InterlockedExchangeAdd64(&v6[1]._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(v6 + 1);
  KeAbPostRelease(&v6[1]);
  KeLeaveCriticalRegion();
LABEL_8:
  if( v8 )
  {
    ExReleaseRundownProtection((_EX_RUNDOWN_REF *)&ExBootDevicesRemovedEvent + 152);
    KeLeaveCriticalRegion();
  }
}

Referenced by: