EtwpStopLoggerInstance

NTSTATUS __stdcall EtwpStopLoggerInstance(_WMI_LOGGER_CONTEXT *LoggerContext){
  _ETW_SILODRIVERSTATE *SiloState; 
  unsigned int Flags; 
  unsigned int v4; 
  _ETHREAD *CurrentThread; 
  __int64 v6; 
  unsigned int v7; 
  PERIODIC_CAPTURE_STATE_CONTEXT *PeriodicCaptureStateContext; 
  INT64 Timer; 

  SiloState = LoggerContext->SiloState;
  _InterlockedOr((volatile signed __int32 *)&LoggerContext->832, 0x40u);
  if( (LoggerContext->LoggerMode & 0x2000000) != 0 )
    EtwpUpdateLoggerGroupMasks((_KTRAP_FRAME *)LoggerContext, 0i64);
  Flags = LoggerContext->Flags;
  if( (Flags & 0x20) == 0 )
  {
    EtwpDisableTraceProviders(SiloState, LoggerContext->LoggerId);
    Flags = LoggerContext->Flags;
  }
  if( (Flags & 0x4000) != 0 )
  {
    v4 = 0;
    while( SiloState->EtwpSecurityLoggers[v4] != LoggerContext->LoggerId )
    {
      if( ++v4 >= 8 )
        goto LABEL_11;
    }
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    ExAcquirePushLockExclusiveEx(&SiloState->EtwpSecurityProviderGuidEntry.Lock, 0i64);
    SiloState->EtwpSecurityProviderEnableMask &= ~(1 << v4);
    v6 = v4;
    *(_OWORD *)&SiloState->EtwpSecurityProviderGuidEntry.EnableInfo[v6].IsEnabled = 0i64;
    *(_OWORD *)&SiloState->EtwpSecurityProviderGuidEntry.EnableInfo[v6].MatchAnyKeyword = 0i64;
    SiloState->EtwpSecurityLoggers[v4] = 0;
    SiloState->EtwpSecurityProviderGuidEntry.LockOwner = 0i64;
    ExReleasePushLockEx((_DWORD)SiloState + 432, 0);
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
  }
LABEL_11:
  if( (LoggerContext->LoggerMode & 0x400) == 0 )
  {
    v7 = LoggerContext->Flags;
    if( (v7 & 0x800) != 0 )
    {
      EtwpLogPmcCounterRundown(LoggerContext, LoggerContext->LoggerId);
      v7 = LoggerContext->Flags;
    }
    if( (v7 & 0x1000000) != 0 )
      EtwpStackRundown((_SLIST_HEADER *)LoggerContext->StackCache, (UINT64)SiloState);
  }
  if( !_InterlockedExchange(&LoggerContext->CollectionOn, 0) )
    return -2147483611;
  PeriodicCaptureStateContext = LoggerContext->PeriodicCaptureStateContext;
  if( PeriodicCaptureStateContext )
  {
    Timer = (INT64)PeriodicCaptureStateContext->Timer;
    if( Timer )
      ExCancelTimer(Timer);
  }
  SiloState->EtwpLoggerContext[LoggerContext->LoggerId] = (_WMI_LOGGER_CONTEXT *)((unsigned __int64)LoggerContext | 1);
  if( ObGetCurrentIrql() > 2u )
  {
    if( !_interlockedbittestandset((volatile signed __int32 *)&LoggerContext->836, 8u) )
      KeInsertQueueDpc((UINT64)&LoggerContext->LoggerDpc, 0i64, 0i64);
  }
  else
  {
    KeSetEvent((PRKEVENT)&LoggerContext->gap1D4[28], 0, 0);
  }
  EtwpSendSessionNotification(LoggerContext, 2, 0i64);
  return 0;
}

Referenced by: