EtwpUnregisterPartitionPages

__int64 __fastcall EtwpUnregisterPartitionPages(_QWORD *a1, __int64 a2){
  __int64 v3; 
  void *v4; 
  unsigned __int64 v6; 
  int v7; 
  __int64 v8; 
  __int64 v9; 
  int v10; 
  __int64 v11; 
  _QWORD *i; 
  __int64 v14; 
  __int64 v15; 

  v3 = 0i64;
  v4 = 0i64;
  v6 = (unsigned __int8)ExAcquireSpinLockExclusive((INT64 *)&ExBootDevicesRemovedEvent + 146);
  v7 = *(&ExBootDevicesRemovedEvent + 289) >> 5;
  v8 = -1i64 << (*(&ExBootDevicesRemovedEvent + 1156) & 0x1F);
  v9 = a2 & v8;
  if( *(&ExBootDevicesRemovedEvent + 289) >> 5 )
  {
    v10 = v7 - 1;
    v14 = a2 & v8;
    v11 = *(&ExBootDevicesRemovedEvent + 145)
        + 8i64
        * ((v7 - 1) & (HIBYTE(v14)
                     + 37
                     * (BYTE6(v14)
                      + 37
                      * (BYTE5(v14)
                       + 37
                       * (BYTE4(v14)
                        + 37
                        * (BYTE3(v14)
                         + 37 * (BYTE2(v14) + 37 * (BYTE1(v14) + 37 * ((unsigned int)(unsigned __int8)v9 + 11623883)))))))));
    while( 1 )
    {
      v11 = *(_QWORD *)v11;
      if( (v11 & 1) != 0 )
        break;
      if( v9 == (v8 & *(_QWORD *)(v11 + 8)) )
        goto LABEL_7;
    }
    v11 = 0i64;
LABEL_7:
    if( v11 )
    {
      v3 = *(_QWORD *)(v11 + 16);
      v4 = (void *)v11;
      if( a1 )
        *a1 = *(_QWORD *)(v11 + 24);
      v15 = v8 & *(_QWORD *)(v11 + 8);
      for( i = (_QWORD *)(*(&ExBootDevicesRemovedEvent + 145)
                         + 8i64
                         * (v10 & (HIBYTE(v15)
                                 + 37
                                 * (BYTE6(v15)
                                  + 37
                                  * (BYTE5(v15)
                                   + 37
                                   * (BYTE4(v15)
                                    + 37
                                    * (BYTE3(v15)
                                     + 37
                                     * (BYTE2(v15)
                                      + 37 * (BYTE1(v15) + 37 * ((unsigned int)(unsigned __int8)v15 + 11623883))))))))));
            (*i & 1) == 0;
            i = (_QWORD *)*i )
      {
        if( *i == v11 )
        {
          *i = *(_QWORD *)v11;
          --*(&ExBootDevicesRemovedEvent + 288);
          *(_QWORD *)v11 |= 0x8000000000000002ui64;
          break;
        }
      }
    }
  }
  ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)&ExBootDevicesRemovedEvent + 146);
  __writecr8(v6);
  if( v4 )
    ExFreePoolWithTag(v4, 0x4F777445u);
  return v3;
}

Referenced by: