EtwpCovSampModuleDereference
NTSTATUS __stdcall EtwpCovSampModuleDereference(INT64 a1, INT64 a2){
signed __int64 v2;
bool v3;
signed __int64 v4;
v2 = _InterlockedExchangeAdd64((volatile signed __int64 *)(a2 + 64), 0xFFFFFFFFFFFFFFFFui64);
v3 = v2 <= 1;
v4 = v2 - 1;
if( v3 )
{
if( v4 )
__fastfail(0xEu);
}
else if( v4 == 1 && !*(_DWORD *)(a2 + 132) && a1 )
{
_InterlockedIncrement((volatile signed __int32 *)(a1 + 1124));
}
return v4;
}Referenced by:
EtwpCovSampImageNotify
EtwpCovSampProcessCleanup
EtwpCovSampProcessRemoveModule