EtwpCovSampCaptureContextStop
void __fastcall EtwpCovSampCaptureContextStop(INT64 a1){
_ETHREAD *CurrentThread;
UINT64 *v3;
unsigned __int8 v4;
unsigned __int64 v5;
__int64 *i;
_LARGE_INTEGER v7;
void *v8;
void *v9;
_LARGE_INTEGER v10;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
v3 = (UINT64 *)(a1 + 264);
v4 = KeAcquireSpinLockRaiseToDpc((UINT64 *)(a1 + 264));
*(_DWORD *)(a1 + 912) = 0;
v5 = v4;
if( *(_DWORD *)(a1 + 916) )
*(_DWORD *)(a1 + 916) = 0;
for( i = *(__int64 **)(a1 + 576); i != (__int64 *)(a1 + 576); i = (__int64 *)*i )
{
*((_DWORD *)i + 6) = 0;
*((_DWORD *)i + 7) = 0;
}
KeResetEvent((_KEVENT *)(a1 + 888));
*(_DWORD *)(a1 + 920) = 0;
KxReleaseSpinLock(v3);
__writecr8(v5);
EtwpCovSampCaptureFlushSampleBuffers(a1);
EtwpCovSampCaptureCleanupLookasides(a1);
v7.QuadPart = -2500000i64;
for( v10.QuadPart = -2500000i64; KeWaitForSingleObject(a1 + 888, 0, 0, 0, (INT64)&v10); v10 = v7 )
{
EtwpCovSampCaptureCancelApcs(a1);
EtwpCovSampCaptureFlushSampleBuffers(a1);
v7.QuadPart *= 2i64;
if( v7.QuadPart < -9600000000i64 )
v7.QuadPart = -9600000000i64;
}
EtwpCovSampCaptureFreeLookasides((union _SLIST_HEADER *)a1);
v8 = *(void **)(a1 + 952);
if( v8 )
{
ExFreePoolWithTag(v8, 0x56777445u);
*(_QWORD *)(a1 + 952) = 0i64;
}
v9 = *(void **)(a1 + 960);
if( v9 )
{
ExFreePoolWithTag(v9, 0x56777445u);
*(_QWORD *)(a1 + 960) = 0i64;
}
*(_QWORD *)(a1 + 944) = 0i64;
KeLeaveCriticalRegionThread(KeGetCurrentThread());
}Referenced by:
EtwpCoverageSamplerStop