EtwpTracingProvEnableCallback

void __fastcall EtwpTracingProvEnableCallback(const _GUID *a1, int a2){
  _ETW_SILODRIVERSTATE *v2; 
  char v3; 
  unsigned int i; 
  _ETW_GUID_ENTRY *j; 
  _WMI_LOGGER_CONTEXT *v6; 
  __int64 v7; 
  _WMI_LOGGER_CONTEXT *v8; 
  _ETHREAD *CurrentThread; 
  __int64 v10; 
  unsigned int v11; 
  _DWORD *v12; 
  __int64 v13; 
  _ETW_GUID_ENTRY *NextGuidEntry; 
  __int64 v15; 
  _ETW_GUID_ENTRY *k; 
  __int64 v17; 
  _ETHREAD *v18; 
  __int64 v19; 
  unsigned int v20; 
  _EX_PUSH_LOCK *v21; 
  __int64 v22; 
  _EX_PUSH_LOCK *m; 
  __int64 v24; 
  _ETW_GUID_ENTRY *v25; 
  _EX_PUSH_LOCK *v26; 

  if( a2 == 2 )
  {
    v2 = (_ETW_SILODRIVERSTATE *)EtwpHostSiloState;
    v3 = 0;
    for( i = 0; i < *(_DWORD *)(EtwpHostSiloState + 16); ++i )
    {
      v6 = EtwpAcquireLoggerContextByLoggerId(v2, i, 0);
      v8 = v6;
      if( v6 )
      {
        EtwpEventWriteTemplateSession(v7, (const _EVENT_DESCRIPTOR *)ETW_EVENT_SESSION_INFO, (__int64)v6);
        EtwpReleaseLoggerContext(v8, 0);
      }
      v2 = (_ETW_SILODRIVERSTATE *)EtwpHostSiloState;
    }
    for( j = 0i64; ; j = (_ETW_GUID_ENTRY *)v15 )
    {
      NextGuidEntry = EtwpGetNextGuidEntry(v2, j, EtwGroupGuidType);
      v15 = (__int64)NextGuidEntry;
      if( !NextGuidEntry )
        break;
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --CurrentThread->Tcb.KernelApcDisable;
      ExAcquirePushLockExclusiveEx(&NextGuidEntry->Lock, 0i64);
      *(_QWORD *)(v15 + 416) = KeGetCurrentThread();
      if( EtwEventEnabled(*(&ExBootDevicesRemovedEvent + 241), &ETW_EVENT_GROUP_ENTRY_INFO) )
        EtwpEventWriteGuidEntry(v10, &ETW_EVENT_GROUP_ENTRY_INFO, v15);
      v11 = 0;
      v12 = (_DWORD *)(v15 + 128);
      do
      {
        if( *v12 && EtwEventEnabled(*(&ExBootDevicesRemovedEvent + 241), &ETW_EVENT_ENABLE_INFO) )
          EtwpEventWriteEnableInfo(v13, v15, v11);
        ++v11;
        v12 += 8;
      }
      while( v11 < 8 );
      *(_QWORD *)(v15 + 416) = 0i64;
      ExReleasePushLockEx(v15 + 408, 0);
      KeLeaveCriticalRegionThread(KeGetCurrentThread());
      v2 = (_ETW_SILODRIVERSTATE *)EtwpHostSiloState;
    }
    for( k = 0i64; ; k = (_ETW_GUID_ENTRY *)v26 )
    {
      v25 = EtwpGetNextGuidEntry((_ETW_SILODRIVERSTATE *)EtwpHostSiloState, k, EtwTraceGuidType);
      v26 = (_EX_PUSH_LOCK *)v25;
      if( !v25 )
        break;
      v17 = *(_QWORD *)&v25->Guid.Data1 - *(_QWORD *)&EventTracingProvGuid;
      if( !v17 )
        v17 = v26[6]._bf_0 - *((_QWORD *)&EventTracingProvGuid + 1);
      if( v17 )
      {
        v18 = (_ETHREAD *)KeGetCurrentThread();
        --v18->Tcb.KernelApcDisable;
        ExAcquirePushLockExclusiveEx(v26 + 51, 0i64);
        v3 = 1;
        v26[52]._bf_0 = (__int64)KeGetCurrentThread();
      }
      if( EtwEventEnabled(*(&ExBootDevicesRemovedEvent + 241), &ETW_EVENT_GUID_ENTRY_INFO) )
        EtwpEventWriteGuidEntry(v19, &ETW_EVENT_GUID_ENTRY_INFO, (__int64)v26);
      v20 = 0;
      v21 = v26 + 16;
      do
      {
        if( LODWORD(v21->_bf_0) && EtwEventEnabled(*(&ExBootDevicesRemovedEvent + 241), &ETW_EVENT_ENABLE_INFO) )
          EtwpEventWriteEnableInfo(v22, (__int64)v26, v20);
        ++v20;
        v21 += 4;
      }
      while( v20 < 8 );
      for( m = (_EX_PUSH_LOCK *)v26[7]._bf_0; m != &v26[7]; m = (_EX_PUSH_LOCK *)m->_bf_0 )
      {
        if( EtwEventEnabled(*(&ExBootDevicesRemovedEvent + 241), &ETW_EVENT_REG_ENTRY_INFO) )
          EtwpEventWriteRegEntry(v24, (__int64)m);
      }
      if( v3 )
      {
        v26[52]._bf_0 = 0i64;
        ExReleasePushLockEx((_DWORD)v26 + 408, 0);
        KeLeaveCriticalRegionThread(KeGetCurrentThread());
        v3 = 0;
      }
    }
  }
}

Referenced by: