EtwpUnreferenceGuidEntry

INT64 __fastcall EtwpUnreferenceGuidEntry(PVOID P){
  INT64 v2; 
  _ETHREAD *CurrentThread; 
  int v5; 
  int v6; 
  int v7; 
  int v8; 
  __int64 v9; 
  volatile INT64 *v10; 
  _QWORD *v11; 
  PVOID *v12; 
  v2 = _InterlockedDecrement64((volatile signed __int64 *)P + 4);
  if( v2 )
  {
    if( v2 < 0 )
      KeBugCheckEx(0x11Du, 9ui64, (ULONG_PTR)P, 0i64, 0i64);
  }
  else
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    v5 = *((_DWORD *)P + 10);
    v6 = *((_DWORD *)P + 13);
    v7 = *((_DWORD *)P + 12);
    v8 = *((_DWORD *)P + 11);
    v9 = *((_QWORD *)P + 49);
    --*((_WORD *)CurrentThread + 242);
    v10 = (volatile INT64 *)(56i64 * (((unsigned __int8)v8 ^ (unsigned __int8)(v7 ^ v6 ^ v5)) & 0x3F) + v9 + 512);
    ExAcquirePushLockExclusiveEx((UINT64)v10, 0i64);
    v11 = *(_QWORD **)P;
    if( *(PVOID *)(*(_QWORD *)P + 8i64) != P || (v12 = (PVOID *)*((_QWORD *)P + 1), *v12 != P) )
      __fastfail(3u);
    *v12 = v11;
    v11[1] = v12;
    if( (_InterlockedExchangeAdd64(v10, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(v10);
    KeAbPostRelease((PVOID)v10);
    KeLeaveCriticalRegion();
    EtwpFreeGuidEntry((_ETW_GUID_ENTRY *)P);
  }
  return v2;
}

Referenced by: