EtwpStopLoggerInstance

INT64 __fastcall EtwpStopLoggerInstance(_WMI_LOGGER_CONTEXT *LoggerContext){
  _ETW_SILODRIVERSTATE *v1; 
  int v3; 
  unsigned int v4; 
  _ETHREAD *CurrentThread; 
  __int64 v6; 
  int v7; 
  __int64 v9; 
  UINT64 v10; 
  v1 = (_ETW_SILODRIVERSTATE *)*((_QWORD *)LoggerContext + 135);
  _InterlockedOr((volatile signed __int32 *)LoggerContext + 208, 0x40u);
  if( (*((_DWORD *)LoggerContext + 3) & 0x2000000) != 0 )
    EtwpUpdateLoggerGroupMasks((__int64)LoggerContext, 0i64);
  v3 = *((_DWORD *)LoggerContext + 208);
  if( (v3 & 0x20) == 0 )
  {
    EtwpDisableTraceProviders(v1, *(_DWORD *)LoggerContext);
    v3 = *((_DWORD *)LoggerContext + 208);
  }
  if( (v3 & 0x4000) != 0 )
  {
    v4 = 0;
    while( v1->EtwpSecurityLoggers[v4] != *(_DWORD *)LoggerContext )
    {
      if( ++v4 >= 8 )
        goto LABEL_11;
    }
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 242);
    ExAcquirePushLockExclusiveEx((UINT64)&v1->EtwpSecurityProviderGuidEntry.Lock, 0i64);
    v1->EtwpSecurityProviderEnableMask &= ~(1 << v4);
    v6 = v4;
    *(_OWORD *)&v1->EtwpSecurityProviderGuidEntry.EnableInfo[v6].IsEnabled = 0i64;
    *(_OWORD *)&v1->EtwpSecurityProviderGuidEntry.EnableInfo[v6].MatchAnyKeyword = 0i64;
    v1->EtwpSecurityLoggers[v4] = 0;
    v1->EtwpSecurityProviderGuidEntry.LockOwner = 0i64;
    ExReleasePushLockEx((UINT64)&v1->EtwpSecurityProviderGuidEntry.Lock, 0i64);
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  }
LABEL_11:
  if( (*((_DWORD *)LoggerContext + 3) & 0x400) == 0 )
  {
    v7 = *((_DWORD *)LoggerContext + 208);
    if( (v7 & 0x800) != 0 )
    {
      EtwpLogPmcCounterRundown(LoggerContext, *(_DWORD *)LoggerContext);
      v7 = *((_DWORD *)LoggerContext + 208);
    }
    if( (v7 & 0x1000000) != 0 )
      EtwpStackRundown(*((INT64 ***)LoggerContext + 124), (UINT64)v1, *(_DWORD *)LoggerContext);
  }
  if( !_InterlockedExchange((volatile __int32 *)LoggerContext + 84, 0) )
    return 2147483685i64;
  v9 = *((_QWORD *)LoggerContext + 133);
  if( v9 )
  {
    v10 = *(_QWORD *)(v9 + 8);
    if( v10 )
      ExCancelTimer(v10);
  }
  v1->EtwpLoggerContext[*(_DWORD *)LoggerContext] = (_WMI_LOGGER_CONTEXT *)((unsigned __int64)LoggerContext | 1);
  if( ObGetCurrentIrql() > 2u )
  {
    if( !_interlockedbittestandset((volatile signed __int32 *)LoggerContext + 209, 8u) )
      KeInsertQueueDpc((PRKDPC)((char *)LoggerContext + 584), 0i64, 0i64);
  }
  else
  {
    KeSetEvent((PRKEVENT)((char *)LoggerContext + 496), 0);
  }
  EtwpSendSessionNotification((__int64)LoggerContext, 2u, 0);
  return 0i64;
}

Referenced by: