EtwpTrackGuidEntryRegistrations

NTSTATUS __fastcall EtwpTrackGuidEntryRegistrations(_WMI_LOGGER_CONTEXT *LoggerContext, _EX_PUSH_LOCK *a2, CHAR a3){
  _ETHREAD *CurrentThread; 
  ULONG_PTR v7; 
  _EX_PUSH_LOCK *v8; 
  unsigned int v9; 
  _EX_PUSH_LOCK *i; 
  _ETHREAD *v11; 
  _EX_PUSH_LOCK *v12; 
  INT64 bf_0; 
  INT64 v14; 
  _EJOB *v15; 
  _EJOB *v16; 
  _KAPC_STATE ApcState; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  v7 = (_DWORD)a2 + 408;
  ExAcquirePushLockExclusiveEx(a2 + 51, 0i64);
  v8 = a2 + 16;
  a2[52]._bf_0 = (__int64)KeGetCurrentThread();
  v9 = 0;
  while( !LODWORD(v8->_bf_0) || HIWORD(v8->Ptr) != LoggerContext->LoggerId )
  {
    ++v9;
    v8 += 4;
    if( v9 >= 8 )
      goto LABEL_18;
  }
  for( i = (_EX_PUSH_LOCK *)a2[7]._bf_0; i != &a2[7]; i = (_EX_PUSH_LOCK *)i->_bf_0 )
  {
    if( a3 == 2 )
    {
      v11 = (_ETHREAD *)KeGetCurrentThread();
      v12 = i - 2;
      --v11->Tcb.KernelApcDisable;
      ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)(i[2]._bf_0 + 408), 0i64);
      *(_QWORD *)(i[2]._bf_0 + 416) = KeGetCurrentThread();
    }
    else
    {
      v12 = i;
    }
    if( (v12[12].Value & 0x10000) != 0 )
    {
      EtwpProviderArrivalCallback(LoggerContext, 0, (_ETW_REG_ENTRY *)v12);
    }
    else if( ExAcquireRundownProtection((_EX_RUNDOWN_REF *)(v12[10]._bf_0 + 1112)) )
    {
      bf_0 = v12[10]._bf_0;
      memset(&ApcState, 0, sizeof(ApcState));
      LODWORD(v14) = PsGetProcessServerSilo(bf_0);
      LODWORD(v15) = PsAttachSiloToCurrentThread(v14);
      v16 = v15;
      KiStackAttachProcess(v12[10].Ptr, 0i64, &ApcState);
      EtwpProviderArrivalCallback(LoggerContext, 1, (_ETW_REG_ENTRY *)v12);
      KiUnstackDetachProcess(&ApcState, 0i64);
      PsDetachSiloFromCurrentThread(v16);
      ExReleaseRundownProtection((_EX_RUNDOWN_REF *)(v12[10]._bf_0 + 1112));
    }
    if( a3 == 2 )
    {
      *(_QWORD *)(v12[4]._bf_0 + 416) = 0i64;
      ExReleasePushLockEx(v12[4]._bf_0 + 408, 0);
      KeLeaveCriticalRegionThread(KeGetCurrentThread());
    }
  }
LABEL_18:
  a2[52]._bf_0 = 0i64;
  ExReleasePushLockEx(v7, 0);
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  return 0;
}

Referenced by: