EtwpCovSampModuleDereference

NTSTATUS __stdcall EtwpCovSampModuleDereference(INT64 a1, INT64 a2){
  signed __int64 v2; 
  bool v3; 
  signed __int64 v4; 

  v2 = _InterlockedExchangeAdd64((volatile signed __int64 *)(a2 + 64), 0xFFFFFFFFFFFFFFFFui64);
  v3 = v2 <= 1;
  v4 = v2 - 1;
  if( v3 )
  {
    if( v4 )
      __fastfail(0xEu);
  }
  else if( v4 == 1 && !*(_DWORD *)(a2 + 132) && a1 )
  {
    _InterlockedIncrement((volatile signed __int32 *)(a1 + 1124));
  }
  return v4;
}

Referenced by:

EtwpCovSampImageNotify
EtwpCovSampProcessCleanup
EtwpCovSampProcessRemoveModule