PerfLogImageUnload

VOID __stdcall PerfLogImageUnload(
        _UNICODE_STRING *ImageName,
        _FILE_OBJECT *FileObject,
        VOID *ProcessId,
        VOID *ImageBase,
        UINT64 ImageSize,
        UINT64 ImageChecksum,
        UINT64 ImageSignatureLevel,
        UINT64 ImageSignatureType,
        UINT64 LocksHeld){
  INT64 a9; 
  int v14; 
  __int64 v15; 
  VOID **PoolWithTag; 
  __int64 v17; 
  int v18; 
  _UNICODE_STRING *v19; 
  INT64 a5; 
  INT64 a6; 
  INT64 v22; 
  int v23; 
  INT64 v24; 
  __int64 v25; 
  __int128 v26; 

  a9 = 0i64;
  v24 = 0i64;
  v26 = 0i64;
  v25 = 0i64;
  v14 = 0;
  v23 = 0;
  if( EtwpHostSiloState != -4548 && (*(_DWORD *)(EtwpHostSiloState + 4548) & 4) != 0 )
    EtwpCoverageSamplerUnloadImage((INT64)ProcessId, (UINT64)ImageBase, ImageSize);
  if( ProcessId )
  {
    LODWORD(v15) = RtlImageNtHeader((UINT64)ImageBase);
    if( v15 )
    {
      LODWORD(ImageChecksum) = *(_DWORD *)(v15 + 88);
      v14 = *(_DWORD *)(v15 + 8);
      v23 = v14;
      a9 = *(_QWORD *)(v15 + 48);
      v24 = a9;
    }
  }
  if( FileObject )
  {
    if( (_DWORD)LocksHeld || KeAreAllApcsDisabled() )
    {
      PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x90ui64, 1098347589i64);
      if( PoolWithTag )
      {
        ObfReferenceObject(FileObject);
        PoolWithTag[11] = FileObject;
        PoolWithTag[12] = ProcessId;
        PoolWithTag[13] = ImageBase;
        PoolWithTag[14] = (VOID *)ImageSize;
        *((_DWORD *)PoolWithTag + 30) = ImageChecksum;
        *((_DWORD *)PoolWithTag + 31) = v14;
        *((_DWORD *)PoolWithTag + 32) = ImageSignatureLevel;
        *((_DWORD *)PoolWithTag + 33) = ImageSignatureType;
        PoolWithTag[17] = (VOID *)a9;
        KeInitializeApc(
          (INT64)PoolWithTag,
          (INT64)KeGetCurrentThread(),
          0i64,
          (INT64)xHalTimerWatchdogStop,
          (INT64)EtwpCancelTraceImageUnloadApc,
          (INT64)EtwpTraceImageUnloadApc,
          0,
          (INT64)PoolWithTag);
        if( KeInsertQueueApc((INT64)PoolWithTag, 0i64, 0i64, 0i64) )
          return;
        ExFreePoolWithTag(PoolWithTag, 0);
        HalPutDmaAdapter((PADAPTER_OBJECT)FileObject);
        a9 = v24;
        v14 = v23;
      }
      v17 = 512i64;
    }
    else
    {
      v17 = 1024i64;
    }
    if( *(&stru_140CF2E80 + 599) )
    {
      v18 = (*(__int64(__fastcall **)(_FILE_OBJECT *, __int64, __int128 *, __int64 *))(*(&stru_140CF2E80 + 599) + 24i64))(
              FileObject,
              v17,
              &v26,
              &v25);
      v19 = (_UNICODE_STRING *)&v26;
      if( v18 < 0 )
        v19 = ImageName;
      ImageName = v19;
    }
  }
  LODWORD(v22) = LocksHeld;
  LODWORD(a6) = v14;
  LODWORD(a5) = ImageChecksum;
  EtwpTraceImageUnload(
    ImageName,
    (INT64)ProcessId,
    (INT64)ImageBase,
    ImageSize,
    a5,
    a6,
    ImageSignatureLevel,
    ImageSignatureType,
    a9,
    v22);
  if( v25 )
    (*(void(**)(void))(*(&stru_140CF2E80 + 599) + 32i64))();
}

Referenced by: