EtwpClearSessionAndUnreferenceEntry

INT64 __fastcall EtwpClearSessionAndUnreferenceEntry(INT64 a1, INT64 a2, CHAR a3){
  CHAR v3; 
  _ETHREAD *CurrentThread; 
  int v6; 
  unsigned int v7; 
  UINT64 v8; 
  INT64 v9; 
  INT64 v11; 
  __int64 v12; 
  unsigned __int8 v13; 
  __int64 v14; 
  int v15; 
  __int64 v16; 
  int v17; 
  unsigned __int8 v18; 
  unsigned __int8 v19; 
  __int128 v20; 
  _QWORD *v21; 
  _ETWP_NOTIFICATION_HEADER *v22; 
  _ETW_REG_ENTRY *v23; 
  char *v24; 
  char v25; 
  char v26; 
  unsigned int SchematizedFilterSize; 
  unsigned int v28; 
  unsigned int v29; 
  int v30; 
  _ETW_GUID_ENTRY *GuidEntry; 
  _ETHREAD *v32; 
  char v33; 
  char v34; 
  _ETWP_NOTIFICATION_HEADER *DataBlock; 
  int v37; 
  __int64 v38; 
  int v39; 
  int v40; 
  __int128 v41; 
  __int128 v42; 
  _TRACE_ENABLE_INFO Source2; 
  v40 = a1;
  memset(&Source2, 0, sizeof(Source2));
  v3 = a3;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v6 = a1;
  v33 = 0;
  DataBlock = 0i64;
  v7 = 0;
  --*((_WORD *)CurrentThread + 242);
  ExAcquirePushLockExclusiveEx(a2 + 408, 0i64);
  *(_QWORD *)(a2 + 416) = KeGetCurrentThread();
  v39 = *(unsigned __int16 *)(a2 + 88);
  if( v39 == v6 )
    *(_OWORD *)(a2 + 80) = 0i64;
  v8 = 0i64;
  v9 = a2 + 128;
  while( *(_DWORD *)v9 != 1 || *(unsigned __int16 *)(v9 + 6) != v6 )
  {
    v8 = (unsigned int)(v8 + 1);
    v9 += 32i64;
    if( (unsigned int)v8 >= 8 )
    {
      v34 = 0;
      goto LABEL_7;
    }
  }
  *(_DWORD *)v9 = 0;
  v11 = a2 + 132;
  v12 = 0i64;
  v41 = 0ui64;
  v13 = 0;
  *(_QWORD *)&v42 = 0i64;
  v14 = -1i64;
  v15 = 1 << v8;
  v16 = 8i64;
  *((_QWORD *)&v42 + 1) = -1i64;
  v17 = 0;
  do
  {
    if( *(_DWORD *)(v11 - 4) )
    {
      v18 = *(_BYTE *)v11;
      v19 = v13;
      LODWORD(v41) = 1;
      if( v13 <= v18 )
        v19 = v18;
      v12 |= *(_QWORD *)(v11 + 12);
      v14 &= *(_QWORD *)(v11 + 20);
      v13 = v19;
      v17 |= *(_DWORD *)(v11 + 4);
    }
    v11 += 32i64;
    --v16;
  }
  while( v16 );
  *(_QWORD *)&v42 = v12;
  BYTE4(v41) = v13;
  *((_QWORD *)&v42 + 1) = v14;
  v20 = v42;
  DWORD2(v41) = v17;
  *(_OWORD *)(a2 + 96) = v41;
  *(_OWORD *)(a2 + 112) = v20;
  EtwpUpdateFilterData(a2, v8, 0i64, 1, 0i64);
  v34 = 1;
  v21 = *(_QWORD **)(a2 + 56);
  if( v21 != (_QWORD *)(a2 + 56) )
  {
    v22 = DataBlock;
    LOBYTE(v15) = ~(_BYTE)v15;
    v37 = v15;
    do
    {
      if( v3 )
      {
        v32 = (_ETHREAD *)KeGetCurrentThread();
        v23 = (_ETW_REG_ENTRY *)(v21 - 2);
        v24 = (char *)v21 + 85;
        --*((_WORD *)v32 + 242);
        ExAcquirePushLockExclusiveEx(v21[2] + 408i64, 0i64);
        v22 = DataBlock;
        v33 = 1;
        *(_QWORD *)(v21[2] + 416i64) = KeGetCurrentThread();
      }
      else
      {
        v23 = (_ETW_REG_ENTRY *)v21;
        v24 = (char *)v21 + 100;
      }
      v25 = *v24;
      v21 = (_QWORD *)*v21;
      v26 = *v24 & v15;
      *v24 = v26;
      if( ((v23->Flags & 8) == 0 || v39 == v40) && v26 != v25 )
      {
        EtwpComputeRegEntryEnableInfo(v23, &Source2);
        SchematizedFilterSize = EtwpGetSchematizedFilterSize((_ETW_GUID_ENTRY *)a2, v23->EnableMask);
        v28 = SchematizedFilterSize;
        v29 = 120;
        if( SchematizedFilterSize )
          v29 = SchematizedFilterSize + 136;
        if( v22 )
        {
          if( v22->NotificationSize != v29 || RtlCompareMemory(&v22[1], &Source2, 0x20ui64) != 32 )
          {
            EtwpUnreferenceDataBlock((volatile INT32 *)v22);
            v22 = 0i64;
            DataBlock = 0i64;
          }
          if( v22 )
            goto LABEL_29;
        }
        v30 = EtwpAllocDataBlock(v29, 0i64, &DataBlock);
        v22 = DataBlock;
        v7 = v30;
        if( v30 >= 0 )
        {
          DataBlock->NotificationType = EtwNotificationTypeEnable;
          v22->NotificationSize = v29;
          GuidEntry = v23->GuidEntry;
          BYTE3(v38) = 0;
          v22->DestinationGuid = GuidEntry->Guid;
          *(_TRACE_ENABLE_INFO *)&v22[1].NotificationType = Source2;
          v22[1].DestinationGuid.Data1 = *(_BYTE *)(a2 + 91) & 1;
          LOWORD(v38) = *(_WORD *)(a2 + 88);
          BYTE2(v38) = *(_BYTE *)(a2 + 90);
          HIDWORD(v38) = *(_DWORD *)(a2 + 80);
          *(_QWORD *)&v22[1].TargetPID = v38;
          if( v28 )
          {
            *(_DWORD *)&v22[1].SourceGuid.Data2 = 0x80000000;
            v22[1].SourceGuid.Data1 = v28;
            *(_QWORD *)v22[1].DestinationGuid.Data4 = 136i64;
            EtwpCopySchematizedFilters(
              (_EVENT_FILTER_HEADER *)v22[1].SourceGuid.Data4,
              (_ETW_GUID_ENTRY *)a2,
              v23->EnableMask);
            *(_DWORD *)&v22[1].DestinationGuid.Data2 = 1;
          }
          else
          {
            *(_DWORD *)&v22[1].DestinationGuid.Data2 = 0;
          }
        }
        if( v22 )
LABEL_29:
          v7 = EtwpSendDataBlock(v23, v22);
        LOBYTE(v15) = v37;
      }
      if( v33 )
      {
        v23->GuidEntry->LockOwner = 0i64;
        ExReleasePushLockEx((UINT64)&v23->GuidEntry->Lock, 0i64);
        KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
        v22 = DataBlock;
        v33 = 0;
      }
      v3 = a3;
    }
    while( v21 != (_QWORD *)(a2 + 56) );
    if( v22 )
      EtwpUnreferenceDataBlock((volatile INT32 *)v22);
  }
LABEL_7:
  *(_QWORD *)(a2 + 416) = 0i64;
  ExReleasePushLockEx(a2 + 408, 0i64);
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  if( v34 == 1 )
    EtwpUnreferenceGuidEntry((PVOID)a2);
  return v7;
}

Referenced by: