EtwpCrimsonProvEnableCallback

void __fastcall EtwpCrimsonProvEnableCallback(
        const _GUID *a1,
        int a2,
        __int64 a3,
        UINT64 a4,
        unsigned __int64 a5,
        _EVENT_FILTER_DESCRIPTOR *a6,
        void *a7){
  REGHANDLE v9; 
  int v10; 
  int v11; 
  int v12; 
  BOOL v13; 
  int v14; 
  __int64 v15; 
  int *v16; 
  INT64 v17; 
  unsigned __int64 v18; 
  int v19; 
  unsigned int v20; 
  _WORK_QUEUE_ITEM *PoolWithTag; 
  int v22; 
  UINT8 v23; 
  int v24; 
  UINT64 v25; 
  int v26; 
  int v27; 
  unsigned int v28; 
  int v29; 
  int v30; 
  int v31; 
  int v32; 

  KeWaitForSingleObject((UINT64)&ExBootDevicesRemovedEvent + 2432, 0, 0, 0, 0i64);
  if( (_DWORD)a7 != 1 )
  {
    if( (_DWORD)a7 == 0x2000000 )
    {
      v25 = *(&ExBootDevicesRemovedEvent + 240);
      v26 = EtwProviderEnabled(*(&ExBootDevicesRemovedEvent + 240), 0, 0x10ui64) != 0 ? 0x200 : 0;
      v27 = 100663808;
      v22 = v26 | 0x2000000;
      if( !EtwProviderEnabled(v25, 0, 0x60ui64) )
        v22 = v26;
      v23 = EtwProviderEnabled(v25, 0, 0x1FA0ui64);
      v24 = v22 | 0x4000000;
    }
    else
    {
      if( (_DWORD)a7 != 536870913 )
      {
        v27 = (int)a7;
        v28 = a2 != 0 ? (unsigned int)a7 : 0;
LABEL_26:
        v15 = 1i64;
        goto LABEL_13;
      }
      v27 = 545783808;
      v22 = EtwProviderEnabled(*(&ExBootDevicesRemovedEvent + 251), 0, 0x420ui64) != 0 ? 0x20080000 : 0;
      v23 = EtwProviderEnabled(*(&ExBootDevicesRemovedEvent + 251), 0, 0x40ui64);
      v24 = v22 | 0x20800000;
    }
    if( !v23 )
      v24 = v22;
    v28 = v24;
    goto LABEL_26;
  }
  v9 = *(&ExBootDevicesRemovedEvent + 245);
  v10 = 0;
  if( EtwEventEnabled(*(&ExBootDevicesRemovedEvent + 245), &ProcessStart)
    || EtwEventEnabled(v9, &EnableProcessTracingCallbacks) )
  {
    v10 = 1;
  }
  v11 = v10 | 2;
  if( !EtwEventEnabled(v9, &ThreadStart) )
    v11 = v10;
  v27 = 524295;
  v12 = v11 | 4;
  if( !EtwEventEnabled(v9, &ImageLoad) )
    v12 = v11;
  v13 = EtwEventEnabled(v9, &JobStart);
  v14 = v12 | 0x80000;
  v29 = 536879104;
  if( !v13 )
    v14 = v12;
  v28 = v14;
  v30 = EtwProviderEnabled(v9, 0, 0x180ui64) != 0 ? 0x20002000 : 0;
  v31 = 1073741826;
  v32 = EtwProviderEnabled(v9, 0, 0x200ui64) != 0 ? 0x40000002 : 0;
  if( a2 == 2 )
    EtwpPsProvCaptureState((VOID *)&PsProvGuid, a4);
  v15 = 3i64;
LABEL_13:
  v16 = &v27;
  do
  {
    v17 = EtwpHostSiloState;
    v18 = (unsigned __int64)(unsigned int)v16[1] >> 29;
    v19 = v16[1] & 0x1FFFFFFF;
    v20 = *v16 & ~v16[1];
    v16 += 2;
    *(_DWORD *)(EtwpHostSiloState + 4 * v18 + 4516) |= v19;
    *(_DWORD *)(v17 + 4 * ((unsigned __int64)v20 >> 29) + 4516) &= ~(v20 & 0x1FFFFFFF);
    --v15;
  }
  while( v15 );
  KeReleaseMutex((_KMUTANT *)((char *)&ExBootDevicesRemovedEvent + 2432), 0);
  PoolWithTag = (_WORK_QUEUE_ITEM *)ExAllocatePoolWithTag(0x200ui64, 0x20ui64, 1467446341i64);
  if( PoolWithTag )
  {
    PoolWithTag->List.Flink = 0i64;
    PoolWithTag->WorkerRoutine = (void(__fastcall *)(void *))EtwpUpdateKernelGroupsWork;
    PoolWithTag->Parameter = PoolWithTag;
    ExQueueWorkItem(PoolWithTag, DelayedWorkQueue);
  }
}

Referenced by: