EtwpCancelTraceImageUnloadApc

NTSTATUS __stdcall EtwpCancelTraceImageUnloadApc(PVOID P){
  __int64 v2; 
  int v3; 
  _UNICODE_STRING *v4; 
  INT64 a5; 
  INT64 a6; 
  INT64 v8; 
  __int128 v9; 
  __int64 v10; 

  v10 = 0i64;
  v9 = 0i64;
  v2 = *((_QWORD *)P + 11);
  if( *(&stru_140CF2E80 + 599) )
    v3 = (*(__int64(__fastcall **)(__int64, __int64, __int128 *, __int64 *))(*(&stru_140CF2E80 + 599) + 24i64))(
           v2,
           512i64,
           &v9,
           &v10);
  else
    v3 = -1073741637;
  if( v3 < 0 )
    v4 = (_UNICODE_STRING *)(*((_QWORD *)P + 11) + 88i64);
  else
    v4 = (_UNICODE_STRING *)&v9;
  LODWORD(v8) = 0;
  LODWORD(a6) = *((_DWORD *)P + 31);
  LODWORD(a5) = *((_DWORD *)P + 30);
  EtwpTraceImageUnload(
    v4,
    *((_QWORD *)P + 12),
    *((_QWORD *)P + 13),
    *((_QWORD *)P + 14),
    a5,
    a6,
    *((_DWORD *)P + 32),
    *((_DWORD *)P + 33),
    *((_QWORD *)P + 17),
    v8);
  if( v10 )
    (*(void(**)(void))(*(&stru_140CF2E80 + 599) + 32i64))();
  ObfDereferenceObjectWithTag(*((VOID **)P + 11), 0x746C6644ui64);
  return(unsigned int)ExFreePoolWithTag(P, 0);
}

Referenced by: