PfSnDeactivateTrace

NTSTATUS __stdcall PfSnDeactivateTrace(PFSN_TRACE_HEADER *Trace){
  unsigned __int64 v2; 
  unsigned __int64 v3; 
  __int64 v4; 
  PFSN_TRACE_HEADER **v5; 

  v2 = (unsigned __int8)KeAcquireSpinLockRaiseToDpc(&qword_140C50190);
  KxReleaseSpinLock(&qword_140C50190);
  __writecr8(v2);
  PfSnRemoveProcessTrace(*((_EPROCESS **)Trace + 44));
  ExReleaseRundownProtection((_EX_RUNDOWN_REF *)Trace + 45);
  PfSnCancelTraceTimer(Trace);
  ExWaitForRundownProtectionRelease((_EX_RUNDOWN_REF *)Trace + 45);
  v3 = (unsigned __int8)KeAcquireSpinLockRaiseToDpc(&qword_140C50190);
  v4 = *((_QWORD *)Trace + 1);
  v5 = (PFSN_TRACE_HEADER **)*((_QWORD *)Trace + 2);
  if( *(PFSN_TRACE_HEADER **)(v4 + 8) != Trace + 2 || *v5 != Trace + 2 )
    __fastfail(3u);
  --PfSnNumActiveTraces;
  *v5 = (PFSN_TRACE_HEADER *)v4;
  *(_QWORD *)(v4 + 8) = v5;
  KxReleaseSpinLock(&qword_140C50190);
  __writecr8(v3);
  return 0;
}

Referenced by: