SendCaptureStateNotificationsWorker

VOID __stdcall SendCaptureStateNotificationsWorker(_WMI_LOGGER_CONTEXT *LoggerContext){
  __int64 v2; 
  _EX_PUSH_LOCK *p_LoggerLock; 
  unsigned int v4; 
  VOID **PoolWithTag; 
  _GUID *v6; 
  _ETW_GUID_ENTRY *GuidEntryByGuid; 
  _ETW_GUID_ENTRY *v8; 
  _ETHREAD *CurrentThread; 
  _LIST_ENTRY *Flink; 
  int v11; 
  unsigned __int16 *p_LoggerId; 
  __int64 v13; 
  UINT8 EnableMask; 
  _ETWP_NOTIFICATION_HEADER *NotificationPacket; 
  __int64 v16; 
  _GUID *Guid; 
  PERIODIC_CAPTURE_STATE_CONTEXT *PeriodicCaptureStateContext; 
  _ETW_ENABLE_NOTIFICATION_PACKET EnableNotification; 
  _EXT_SET_PARAMETERS_V0 Parameters; 

  NotificationPacket = 0i64;
  Parameters = 0i64;
  memset(&EnableNotification.gap0[8], 0i64, 0x70u);
  p_LoggerLock = &LoggerContext->LoggerLock;
  PeriodicCaptureStateContext = LoggerContext->PeriodicCaptureStateContext;
  v2 = (__int64)PeriodicCaptureStateContext;
  ExAcquirePushLockExclusiveEx(&LoggerContext->LoggerLock, 0i64);
  PeriodicCaptureStateContext->TimerState = EtwpPeriodicTimerUnset;
  if( !LoggerContext->CollectionOn
    || (v4 = *(unsigned __int16 *)(v2 + 16), !(_WORD)v4)
    || (v16 = *(unsigned __int16 *)(v2 + 16),
        PoolWithTag = ExAllocatePoolWithTag(1ui64, 16i64 * v4, 1953985605i64),
        (Guid = (_GUID *)PoolWithTag) == 0i64) )
  {
LABEL_24:
    if( (_InterlockedExchangeAdd64(&p_LoggerLock->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(p_LoggerLock);
    KeAbPostRelease(p_LoggerLock);
    goto LABEL_27;
  }
  memmove(PoolWithTag, *(const VOID **)(v2 + 24), 16 * v4);
  if( (_InterlockedExchangeAdd64(&p_LoggerLock->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(&LoggerContext->LoggerLock);
  KeAbPostRelease(&LoggerContext->LoggerLock);
  *(_DWORD *)EnableNotification.gap0 = 3;
  *(_DWORD *)&EnableNotification.gap0[4] = 120;
  v6 = Guid;
  do
  {
    GuidEntryByGuid = EtwpFindGuidEntryByGuid(LoggerContext->SiloState, v6, EtwTraceGuidType);
    v8 = GuidEntryByGuid;
    if( GuidEntryByGuid )
    {
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --CurrentThread->Tcb.KernelApcDisable;
      ExAcquirePushLockExclusiveEx(&GuidEntryByGuid->Lock, 0i64);
      Flink = v8->RegListHead.Flink;
      v8->LockOwner = (_ETHREAD *)KeGetCurrentThread();
      for( *(_GUID *)&EnableNotification.gap0[40] = *v6; Flink != &v8->RegListHead; Flink = Flink->Flink )
      {
        if( (BYTE2(Flink[6].Flink) & 1) == 0 )
        {
          v11 = 0;
          p_LoggerId = &v8->EnableInfo[0].LoggerId;
          do
          {
            EnableMask = BYTE4(Flink[6].Flink);
            if( ((unsigned __int8)(1 << v11) & EnableMask) != 0 )
            {
              if( *(_DWORD *)(p_LoggerId - 3) )
              {
                if( *p_LoggerId == LoggerContext->LoggerId )
                {
                  EtwpComputeRegEntryEnableInfo((_ETW_REG_ENTRY *)Flink, &EnableNotification.EnableInfo);
                  EnableNotification.EnableInfo.LoggerId = LoggerContext->LoggerId;
                  EnableNotification.EnableInfo.IsEnabled = 2;
                  if( EtwpBuildNotificationPacket(v8, &EnableNotification, EnableMask, &NotificationPacket) >= 0 )
                  {
                    EtwpSendDataBlock((_ETW_REG_ENTRY *)Flink, NotificationPacket);
                    EtwpUnreferenceDataBlock(NotificationPacket);
                  }
                }
              }
            }
            ++v11;
            p_LoggerId += 16;
          }
          while( v11 < 8 );
        }
      }
      v8->LockOwner = 0i64;
      ExReleasePushLockEx((_DWORD)v8 + 408, 0);
      KeLeaveCriticalRegionThread(KeGetCurrentThread());
      EtwpUnreferenceGuidEntry(v8);
    }
    ++v6;
    --v16;
  }
  while( v16 );
  v13 = (__int64)PeriodicCaptureStateContext;
  p_LoggerLock = &LoggerContext->LoggerLock;
  if( LoggerContext->CollectionOn )
  {
    Parameters.NoWakeTolerance = -1i64;
    ExAcquirePushLockExclusiveEx(p_LoggerLock, 0i64);
    if( *(_WORD *)(v13 + 16) && !*(_DWORD *)(v13 + 64) )
    {
      ExSetTimer(*(_QWORD *)(v13 + 8), *(_QWORD *)v13, 0i64, (INT64)&Parameters);
      *(_DWORD *)(v13 + 64) = 1;
    }
    goto LABEL_24;
  }
LABEL_27:
  EtwpReleaseLoggerContext(LoggerContext, 0);
}

Referenced by: