EtwUnregister

NTSTATUS __fastcall EtwUnregister(UINT64 a1){
  _ETHREAD *v2; 
  __int64 v3; 
  _QWORD *v4; 
  __int64 v5; 
  _QWORD *v6; 
  __int64 v7; 
  __int64 v8; 
  __int64 v9; 
  _ETW_GUID_ENTRY *v10; 
  _ETHREAD *CurrentThread; 

  if( !a1 )
    return -1073741816;
  if( (*(_BYTE *)(a1 + 98) & 1) == 0 )
    KeBugCheckEx(0x11Du, (PVOID)4, (PVOID)a1, (PVOID)1, 0i64);
  if( *(_QWORD *)(a1 + 40) )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)(*(_QWORD *)(a1 + 40) + 408i64), 0i64);
    *(_QWORD *)(*(_QWORD *)(a1 + 40) + 416i64) = KeGetCurrentThread();
  }
  v2 = (_ETHREAD *)KeGetCurrentThread();
  --v2->Tcb.KernelApcDisable;
  ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)(*(_QWORD *)(a1 + 32) + 408i64), 0i64);
  *(_QWORD *)(*(_QWORD *)(a1 + 32) + 416i64) = KeGetCurrentThread();
  v3 = *(_QWORD *)a1;
  if( *(_QWORD *)(*(_QWORD *)a1 + 8i64) != a1
    || (v4 = *(_QWORD **)(a1 + 8), *v4 != a1)
    || (*v4 = v3, *(_QWORD *)(v3 + 8) = v4, v5 = *(_QWORD *)(a1 + 16), *(_QWORD *)(v5 + 8) != a1 + 16)
    || (v6 = *(_QWORD **)(a1 + 24), *v6 != a1 + 16) )
  {
    __fastfail(3u);
  }
  *v6 = v5;
  *(_QWORD *)(v5 + 8) = v6;
  *(_QWORD *)(*(_QWORD *)(a1 + 32) + 416i64) = 0i64;
  ExReleasePushLockEx(*(_QWORD *)(a1 + 32) + 408, 0);
  KeLeaveCriticalRegion();
  v7 = *(_QWORD *)(a1 + 40);
  if( v7 )
  {
    *(_QWORD *)(v7 + 416) = 0i64;
    ExReleasePushLockEx(*(_QWORD *)(a1 + 40) + 408, 0);
    KeLeaveCriticalRegion();
  }
  if( EtwEventEnabled(*(&ExBootDevicesRemovedEvent + 241), &ETW_EVENT_PROVIDER_UNREGISTERS) )
    EtwpEventWriteTemplateSessAndProv(v8, &ETW_EVENT_PROVIDER_UNREGISTERS, v9, 1, 0i64, *(_QWORD *)(a1 + 32) + 40i64);
  EtwpUnreferenceGuidEntry(*(_ETW_GUID_ENTRY **)(a1 + 32));
  v10 = *(_ETW_GUID_ENTRY **)(a1 + 40);
  if( v10 )
    EtwpUnreferenceGuidEntry(v10);
  EtwpReleaseProviderTraitsReference((_ETW_REG_ENTRY *)a1);
  ExFreePoolWithTag((PVOID)a1, 0);
  return 0;
}

Referenced by: