EtwpReleaseProviderTraitsReference
INT64 __fastcall EtwpReleaseProviderTraitsReference(INT64 a1){
_DWORD *v1;
char v3;
struct _FAST_MUTEX *v4;
__int64 *v6;
v1 = (_DWORD *)_InterlockedExchange64((volatile __int64 *)(a1 + 104), 0i64);
if( v1 )
{
v3 = *(_BYTE *)(a1 + 98) & 1;
v4 = &EtwpProviderTraitsKmMutex;
if( !v3 )
v4 = &EtwpProviderTraitsUmMutex;
ExAcquireFastMutex(v4);
if( v1[6]-- == 1 )
{
v6 = &EtwpProviderTraitsKmTree;
if( !v3 )
v6 = &EtwpProviderTraitsUmTree;
RtlRbRemoveNode((unsigned __int64 *)v6, (unsigned __int64)v1);
}
else
{
v1 = 0i64;
}
KeReleaseGuardedMutex(v4);
if( v1 )
ExFreePoolWithTag(v1, 0);
}
return 0i64;
}Referenced by:
EtwUnregister
EtwpDeleteRegistrationObject
EtwpSetProviderTraitsCommon