EtwpCancelTraceImageUnloadApc

NTSTATUS __stdcall EtwpCancelTraceImageUnloadApc(PVOID P){
  __int64 v2; 
  int v3; 
  __int128 *v4; 
  NTSTATUS result; 
  INT64 v6; 
  INT64 v7; 
  INT64 v8; 
  __int128 v9; 
  __int64 v10; 
  v10 = 0i64;
  v9 = 0i64;
  v2 = *((_QWORD *)P + 11);
  if( FltMgrCallbacks )
    v3 = (*(__int64(__fastcall **)(__int64, __int64, __int128 *, __int64 *))(FltMgrCallbacks + 24))(
           v2,
           512i64,
           &v9,
           &v10);
  else
    v3 = -1073741637;
  if( v3 < 0 )
    v4 = (__int128 *)(*((_QWORD *)P + 11) + 88i64);
  else
    v4 = &v9;
  LODWORD(v8) = 0;
  LODWORD(v7) = *((_DWORD *)P + 31);
  LODWORD(v6) = *((_DWORD *)P + 30);
  EtwpTraceImageUnload(
    (INT64)v4,
    *((_QWORD *)P + 12),
    *((_QWORD *)P + 13),
    *((_QWORD *)P + 14),
    v6,
    v7,
    *((_DWORD *)P + 32),
    *((_DWORD *)P + 33),
    *((_QWORD *)P + 17),
    v8);
  if( v10 )
    (*(void(**)(void))(FltMgrCallbacks + 32))();
  ObfDereferenceObjectWithTag(*((PVOID *)P + 11), 0x746C6644ui64);
  ExFreePoolWithTag(P, 0);
  return result;
}

Referenced by: