EtwpClearSessionAndUnreferenceEntry

NTSTATUS __stdcall EtwpClearSessionAndUnreferenceEntry(UINT64 LoggerId, _ETW_GUID_ENTRY *GuidEntry, UINT8 GuidType){
  UINT8 v3; 
  _ETHREAD *CurrentThread; 
  int v6; 
  NTSTATUS v7; 
  UINT64 v8; 
  _TRACE_ENABLE_INFO *v9; 
  unsigned __int8 *p_Level; 
  __int64 v12; 
  unsigned __int8 v13; 
  __int64 v14; 
  int v15; 
  __int64 v16; 
  int v17; 
  unsigned __int8 v18; 
  unsigned __int8 v19; 
  __int128 v20; 
  _ETW_GUID_ENTRY *Flink; 
  _ETWP_NOTIFICATION_HEADER *v22; 
  _ETW_GUID_ENTRY *v23; 
  unsigned __int8 *v24; 
  unsigned __int8 v25; 
  unsigned __int8 v26; 
  int SchematizedFilterSize; 
  int v28; 
  unsigned int v29; 
  NTSTATUS v30; 
  volatile __int64 RefCount; 
  _ETHREAD *v32; 
  char v33; 
  char v34; 
  _ETWP_NOTIFICATION_HEADER *DataBlock; 
  int v37; 
  __int64 v38; 
  int v39; 
  int v40; 
  __int128 v41; 
  __int128 v42; 
  _TRACE_ENABLE_INFO EnableInfo; 

  v40 = LoggerId;
  memset(&EnableInfo, 0, sizeof(EnableInfo));
  v3 = GuidType;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v6 = LoggerId;
  v33 = 0;
  DataBlock = 0i64;
  v7 = 0;
  --CurrentThread->Tcb.KernelApcDisable;
  ExAcquirePushLockExclusiveEx(&GuidEntry->Lock, 0i64);
  GuidEntry->LockOwner = (_ETHREAD *)KeGetCurrentThread();
  v39 = GuidEntry->LastEnable.LoggerId;
  if( v39 == v6 )
    GuidEntry->80 = 0i64;
  v8 = 0i64;
  v9 = GuidEntry->EnableInfo;
  while( v9->IsEnabled != 1 || v9->LoggerId != v6 )
  {
    v8 = (unsigned int)(v8 + 1);
    ++v9;
    if( (unsigned int)v8 >= 8 )
    {
      v34 = 0;
      goto LABEL_7;
    }
  }
  v9->IsEnabled = 0;
  p_Level = &GuidEntry->EnableInfo[0].Level;
  v12 = 0i64;
  v41 = 0ui64;
  v13 = 0;
  *(_QWORD *)&v42 = 0i64;
  v14 = -1i64;
  v15 = 1 << v8;
  v16 = 8i64;
  *((_QWORD *)&v42 + 1) = -1i64;
  v17 = 0;
  do
  {
    if( *((_DWORD *)p_Level - 1) )
    {
      v18 = *p_Level;
      v19 = v13;
      LODWORD(v41) = 1;
      if( v13 <= v18 )
        v19 = v18;
      v12 |= *(_QWORD *)(p_Level + 12);
      v14 &= *(_QWORD *)(p_Level + 20);
      v13 = v19;
      v17 |= *((_DWORD *)p_Level + 1);
    }
    p_Level += 32;
    --v16;
  }
  while( v16 );
  *(_QWORD *)&v42 = v12;
  BYTE4(v41) = v13;
  *((_QWORD *)&v42 + 1) = v14;
  v20 = v42;
  DWORD2(v41) = v17;
  *(_OWORD *)&GuidEntry->ProviderEnableInfo.IsEnabled = v41;
  *(_OWORD *)&GuidEntry->ProviderEnableInfo.MatchAnyKeyword = v20;
  EtwpUpdateFilterData(GuidEntry, v8, 0i64, 1u, 0i64);
  v34 = 1;
  Flink = (_ETW_GUID_ENTRY *)GuidEntry->RegListHead.Flink;
  if( Flink != (_ETW_GUID_ENTRY *)&GuidEntry->RegListHead )
  {
    v22 = DataBlock;
    LOBYTE(v15) = ~(_BYTE)v15;
    v37 = v15;
    do
    {
      if( v3 )
      {
        v32 = (_ETHREAD *)KeGetCurrentThread();
        v23 = (_ETW_GUID_ENTRY *)((char *)Flink - 16);
        v24 = (unsigned __int8 *)&Flink->MatchId + 5;
        --v32->Tcb.KernelApcDisable;
        ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)&Flink->SiloGuidList.Flink[25].Blink, 0i64);
        v22 = DataBlock;
        v33 = 1;
        Flink->SiloGuidList.Flink[26].Flink = (_LIST_ENTRY *)KeGetCurrentThread();
      }
      else
      {
        v23 = Flink;
        v24 = &Flink->ProviderEnableInfo.Level;
      }
      v25 = *v24;
      Flink = (_ETW_GUID_ENTRY *)Flink->GuidList.Flink;
      v26 = *v24 & v15;
      *v24 = v26;
      if( ((v23->ProviderEnableInfo.IsEnabled & 0x80000) == 0 || v39 == v40) && v26 != v25 )
      {
        EtwpComputeRegEntryEnableInfo((_ETW_REG_ENTRY *)v23, &EnableInfo);
        SchematizedFilterSize = EtwpGetSchematizedFilterSize(GuidEntry, v23->ProviderEnableInfo.Level);
        v28 = SchematizedFilterSize;
        v29 = 120;
        if( SchematizedFilterSize )
          v29 = SchematizedFilterSize + 136;
        if( v22 )
        {
          if( v22->NotificationSize != v29 || RtlCompareMemory(&v22->SourceGuid[1], &EnableInfo, 32) != (_SIZE_T *)32 )
          {
            EtwpUnreferenceDataBlock(v22);
            v22 = 0i64;
            DataBlock = 0i64;
          }
          if( v22 )
            goto LABEL_29;
        }
        v30 = EtwpAllocDataBlock(v29, 0i64, &DataBlock);
        v22 = DataBlock;
        v7 = v30;
        if( v30 >= 0 )
        {
          DataBlock->NotificationType = EtwNotificationTypeEnable;
          v22->NotificationSize = v29;
          RefCount = v23->RefCount;
          BYTE3(v38) = 0;
          v22->DestinationGuid = *(_GUID *)(RefCount + 40);
          *(_TRACE_ENABLE_INFO *)&v22->SourceGuid[1].Data1 = EnableInfo;
          *(_DWORD *)v22->SourceGuid[3].Data4 = GuidEntry->LastEnable._bf_b & 1;
          LOWORD(v38) = GuidEntry->LastEnable.LoggerId;
          BYTE2(v38) = GuidEntry->LastEnable.Level;
          HIDWORD(v38) = GuidEntry->LastEnable.EnableFlags.anonymous_0.LowPart;
          *(_QWORD *)&v22->SourceGuid[3].Data1 = v38;
          if( v28 )
          {
            *(_DWORD *)&v22->SourceGuid[4].Data4[4] = 0x80000000;
            *(_DWORD *)v22->SourceGuid[4].Data4 = v28;
            *(_QWORD *)&v22->SourceGuid[4].Data1 = 136i64;
            EtwpCopySchematizedFilters(&v22->SourceGuid[5], (__int64)GuidEntry, v23->ProviderEnableInfo.Level);
            *(_DWORD *)&v22->SourceGuid[3].Data4[4] = 1;
          }
          else
          {
            *(_DWORD *)&v22->SourceGuid[3].Data4[4] = 0;
          }
        }
        if( v22 )
LABEL_29:
          v7 = EtwpSendDataBlock((_ETW_REG_ENTRY *)v23, v22);
        LOBYTE(v15) = v37;
      }
      if( v33 )
      {
        *(_QWORD *)(v23->RefCount + 416) = 0i64;
        ExReleasePushLockEx(v23->RefCount + 408, 0);
        KeLeaveCriticalRegionThread(KeGetCurrentThread());
        v22 = DataBlock;
        v33 = 0;
      }
      v3 = GuidType;
    }
    while( Flink != (_ETW_GUID_ENTRY *)&GuidEntry->RegListHead );
    if( v22 )
      EtwpUnreferenceDataBlock(v22);
  }
LABEL_7:
  GuidEntry->LockOwner = 0i64;
  ExReleasePushLockEx((_DWORD)GuidEntry + 408, 0);
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  if( v34 == 1 )
    EtwpUnreferenceGuidEntry(GuidEntry);
  return v7;
}

Referenced by: