PfSnRemoveProcessTrace

_PFSN_TRACE_HEADER *__stdcall PfSnRemoveProcessTrace(_EPROCESS *Process){
  __int64 v1; 
  _PFSN_TRACE_HEADER *v2; 
  unsigned int v3; 
  signed __int64 v4; 
  bool v5; 
  signed __int64 v6; 
  unsigned __int64 v7; 
  unsigned __int64 v9; 

  v1 = _InterlockedExchange64((volatile __int64 *)&Process->PrefetchTrace, 0i64);
  v2 = (_PFSN_TRACE_HEADER *)(v1 & 0xFFFFFFFFFFFFFFF0ui64);
  v3 = v1 & 0xF;
  if( v3 )
  {
    _m_prefetchw(v2 + 90);
    v4 = *((_QWORD *)v2 + 45);
    if( (v4 & 1) != 0 )
    {
LABEL_6:
      v9 = v4 & 0xFFFFFFFFFFFFFFFEui64;
      if( _InterlockedExchangeAdd64((volatile signed __int64 *)v9, -(__int64)v3) == v3
        && !_interlockedbittestandreset((volatile signed __int32 *)(v9 + 32), 0) )
      {
        KeSetEvent((PRKEVENT)(v9 + 8), 0, 0);
      }
    }
    else
    {
      while( 1 )
      {
        v6 = _InterlockedCompareExchange64((volatile signed __int64 *)v2 + 45, v4 - 2 * v3, v4);
        v5 = v4 == v6;
        v4 = v6;
        if( v5 )
          break;
        if( (v6 & 1) != 0 )
          goto LABEL_6;
      }
    }
  }
  v7 = (unsigned __int8)KeAcquireSpinLockRaiseToDpc(&qword_140C50190);
  KxReleaseSpinLock(&qword_140C50190);
  __writecr8(v7);
  return v2;
}

Referenced by: