EtwInitialize

VOID __stdcall EtwInitialize(UINT64 Phase){
  INT64 v1; 
  __int64 v2; 
  INT64 v3; 

  if( (unsigned int)Phase >= 2 )
  {
    if( (_DWORD)Phase == 2 )
    {
      v1 = EtwpHostSiloState;
      v2 = 0i64;
      for( EtwpFileSystemReady = 1; (unsigned int)v2 < *(_DWORD *)(EtwpHostSiloState + 16); v2 = (unsigned int)(v2 + 1) )
      {
        if( ExAcquireRundownProtectionCacheAwareEx(*(_QWORD *)(*(_QWORD *)(v1 + 448) + 8 * v2), 1i64) )
        {
          if( (unsigned int)v2 >= *(_DWORD *)(EtwpHostSiloState + 16) )
            v3 = 1i64;
          else
            v3 = *(_QWORD *)(*(_QWORD *)(EtwpHostSiloState + 456) + 8 * v2);
          if( (v3 & 1) == 0 && (*(_DWORD *)(v3 + 12) & 0x400) == 0 && EtwpBuffersFlushRequired(v3) )
          {
            if( ObGetCurrentIrql() > 2u )
            {
              if( !_interlockedbittestandset((volatile signed __int32 *)(v3 + 836), 8u) )
                KeInsertQueueDpc(v3 + 584, 0i64, 0i64);
            }
            else
            {
              KeSetEvent((PRKEVENT)(v3 + 496), 0, 0);
            }
          }
          ExReleaseRundownProtectionCacheAwareEx(*(_QWORD *)(*(_QWORD *)(EtwpHostSiloState + 448) + 8 * v2), 1i64);
        }
        v1 = EtwpHostSiloState;
      }
    }
  }
  else
  {
    EtwpInitialize(Phase);
  }
}

Referenced by: