VslpSkStopProfiling
NTSTATUS __stdcall VslpSkStopProfiling(){
int v0;
__int64 v1;
_QWORD *v2;
__int64 v3;
unsigned __int8 CurrentIrql;
INT64 v6[14];
memset(v6, 0i64, 0x68u);
v0 = VslpEnterIumSecureMode(2u, 76, 0i64, (INT64)v6);
if( v0 >= 0 )
{
VslpUnlockPagesForTransfer((INT64 **)&VslpProfilingTransfer);
memset(&VslpProfilingTransfer, 0i64, 0x48u);
KeCancelTimer((INT64)&stru_140C452E0 + 7712);
v1 = *(unsigned int *)(*(&stru_140C452E0 + 960) + 8i64);
v2 = (_QWORD *)(*(&stru_140C452E0 + 960) + 24i64 + 8 * v1);
if( (_DWORD)v1 )
{
v3 = -1 * v1;
do
{
*v2 = ~v2[v3];
++v2;
--v1;
}
while( v1 );
}
CurrentIrql = KeGetCurrentIrql();
__writecr8(2ui64);
VslpFlushBufferArray();
__writecr8(CurrentIrql);
ExWaitForRundownProtectionRelease((_EX_RUNDOWN_REF *)&stru_140C452E0 + 956);
if( *(&stru_140C452E0 + 960) )
{
ExFreePoolWithTag(*(&stru_140C452E0 + 960), 0x54736D56u);
*(&stru_140C452E0 + 960) = 0i64;
}
*(&stru_140C452E0 + 959) = 0i64;
}
else
{
KeCancelTimer((INT64)&stru_140C452E0 + 7712);
}
return v0;
}Referenced by:
VslpEtwClassicCallback