EtwpDeleteRegistrationObject

VOID __stdcall EtwpDeleteRegistrationObject(VOID *Object){
  __int64 v1; 
  __int64 v2; 
  _ETW_GUID_ENTRY *v4; 
  _ETHREAD *v5; 
  _QWORD *v6; 
  VOID **v7; 
  _QWORD *v8; 
  VOID **v9; 
  void *v10; 
  volatile __int64 *v11; 
  _ETW_QUEUE_ENTRY *v12; 
  _ETHREAD *CurrentThread; 
  _QWORD *v14; 
  VOID **v15; 
  _KQUEUE *v16; 
  _LIST_ENTRY *v17; 
  _LIST_ENTRY *v18; 
  _LIST_ENTRY *v19; 
  _ETW_REG_ENTRY *ReplyObject; 
  _KQUEUE *ReplyQueue; 
  _ETWP_NOTIFICATION_HEADER **v22; 
  _QWORD v23[10]; 

  v1 = *((_QWORD *)Object + 4);
  v2 = 4i64;
  v4 = (_ETW_GUID_ENTRY *)*((_QWORD *)Object + 5);
  if( (*((_BYTE *)Object + 98) & 4) == 0 )
  {
    if( v4 )
    {
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --CurrentThread->Tcb.KernelApcDisable;
      ExAcquirePushLockExclusiveEx(&v4->Lock, 0i64);
      v4->LockOwner = (_ETHREAD *)KeGetCurrentThread();
    }
    v5 = (_ETHREAD *)KeGetCurrentThread();
    --v5->Tcb.KernelApcDisable;
    ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)(v1 + 408), 0i64);
    *(_QWORD *)(v1 + 416) = KeGetCurrentThread();
    v6 = *(_QWORD **)Object;
    if( *(VOID **)(*(_QWORD *)Object + 8i64) == Object )
    {
      v7 = (VOID **)*((_QWORD *)Object + 1);
      if( *v7 == Object )
      {
        *v7 = v6;
        v6[1] = v7;
        v8 = (_QWORD *)*((_QWORD *)Object + 2);
        if( (VOID *)v8[1] == (char *)Object + 16 )
        {
          v9 = (VOID **)*((_QWORD *)Object + 3);
          if( *v9 == (char *)Object + 16 )
          {
            *v9 = v8;
            v8[1] = v9;
            *(_QWORD *)(v1 + 416) = 0i64;
            ExReleasePushLockEx(v1 + 408, 0);
            KeLeaveCriticalRegion();
            if( v4 )
            {
              v4->LockOwner = 0i64;
              ExReleasePushLockEx((_DWORD)v4 + 408, 0);
              KeLeaveCriticalRegion();
            }
            goto LABEL_10;
          }
        }
      }
    }
LABEL_26:
    __fastfail(3u);
  }
  ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)&ExBootDevicesRemovedEvent + 170, 0i64);
  v14 = *(_QWORD **)Object;
  if( *(VOID **)(*(_QWORD *)Object + 8i64) != Object )
    goto LABEL_26;
  v15 = (VOID **)*((_QWORD *)Object + 1);
  if( *v15 != Object )
    goto LABEL_26;
  *v15 = v14;
  v14[1] = v15;
  if( (_InterlockedExchangeAdd64((_QWORD *)&ExBootDevicesRemovedEvent + 170, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock((_EX_PUSH_LOCK *)&ExBootDevicesRemovedEvent + 170);
  KeAbPostRelease((char *)&ExBootDevicesRemovedEvent + 1360);
LABEL_10:
  _InterlockedAnd16((volatile signed __int16 *)Object + 49, 0xFF7Fu);
  v10 = (void *)*((unsigned __int16 *)Object + 49);
  if( ((unsigned __int8)v10 & 2) != 0 )
  {
    v11 = (volatile __int64 *)((char *)Object + 48);
    do
    {
      v12 = (_ETW_QUEUE_ENTRY *)_InterlockedExchange64(v11, 0i64);
      if( v12 )
      {
        ReplyObject = v12->ReplyObject;
        memset(v23, 0i64, 0x48u);
        if( (ReplyObject->Flags & 0x40) == 0 )
        {
          ReplyQueue = (_KQUEUE *)ReplyObject->ReplyQueue;
          *(_OWORD *)&v23[7] = *(_OWORD *)(v1 + 40);
          v23[0] = 0x4800000001i64;
          EtwpQueueReply(ReplyQueue, (_ETWP_NOTIFICATION_HEADER *)v23);
        }
        EtwpReleaseQueueEntry(v12, 2ui64);
      }
      ++v11;
      --v2;
    }
    while( v2 );
    EtwpRundownNotifications(*((_EPROCESS **)Object + 10), (_ETW_REG_ENTRY *)Object);
    ObfDereferenceObjectWithTag(*((VOID **)Object + 10), 0x52777445ui64);
    EtwpReleaseProviderTraitsReference((_ETW_REG_ENTRY *)Object);
  }
  else
  {
    if( ((unsigned __int8)v10 & 4) == 0 )
      KeBugCheckEx(0x11Du, (PVOID)3, Object, v10, 0i64);
    v16 = (_KQUEUE *)*((_QWORD *)Object + 6);
    v17 = KeRundownQueueEx(v16, 1u);
    v18 = v17;
    if( v17 )
    {
      v19 = v17;
      do
      {
        v22 = (_ETWP_NOTIFICATION_HEADER **)v19;
        v19 = v19->Flink;
        EtwpUnreferenceDataBlock(v22[2]);
        ExFreePoolWithTag(v22, 0);
      }
      while( v18 != v19 );
    }
    ExFreePoolWithTag(v16, 0);
  }
  EtwpUnreferenceGuidEntry((_ETW_GUID_ENTRY *)v1);
  if( v4 )
    EtwpUnreferenceGuidEntry(v4);
}

Referenced by: