PfTAccessTracingCleanup

VOID __stdcall PfTAccessTracingCleanup(
        _PFP_TRACING_GLOBALS *TGlobals,
        _PF_KERNEL_GLOBALS *KGlobals,
        _PFP_TRACE_STOP_REASONS StopReason){
  _ETHREAD *CurrentThread; 
  bool v6; 
  _EX_PUSH_LOCK *v7; 
  unsigned int DefaultPagePriority; 
  _QWORD *v9; 
  _QWORD *v10; 
  VOID *v11; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v6 = StopReason == PfpTraceStopSuspend;
  --CurrentThread->Tcb.KernelApcDisable;
  v7 = (_EX_PUSH_LOCK *)(TGlobals + 4);
  ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)TGlobals + 2, 0i64);
  TGlobals[3] |= StopReason;
  DefaultPagePriority = MmGetDefaultPagePriority();
  MmSetAccessLogging(0i64, DefaultPagePriority);
  PfKernelGlobals.AccessBufferMax = 0;
  ExWaitForRundownProtectionRelease(&PfKernelGlobals.AccessBufferRef);
  RtlpInterlockedFlushSList();
  v10 = v9;
  while( v10 )
  {
    v11 = v10;
    v10 = (_QWORD *)*v10;
    MmFreeAccessPfnBuffer(v11, v6);
  }
  MmEnablePeriodicAccessClearing(0);
  PfTAccessTracingInitialize(TGlobals, &PfKernelGlobals, 1ui64);
  if( (_InterlockedExchangeAdd64(&v7->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(v7);
  KeAbPostRelease(v7);
  KeLeaveCriticalRegion();
}

Referenced by: