EtwpRundownNotifications

VOID __fastcall EtwpRundownNotifications(_EPROCESS *Process, _ETW_REG_ENTRY *RegEntry){
  __int64 v2; 
  _ETHREAD *CurrentThread; 
  UINT64 v5; 
  _ETW_REG_ENTRY **v6; 
  _ETW_REG_ENTRY *Flink; 
  volatile INT32 **v8; 
  _ETW_REG_ENTRY **v9; 
  _ETW_REG_ENTRY ***v10; 
  _QWORD *v11; 
  __int64 v12; 
  PVOID P[2]; 
  v2 = *((_QWORD *)Process + 178);
  if( v2 )
  {
    P[1] = P;
    P[0] = P;
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 242);
    v5 = v2 + 16;
    ExAcquirePushLockExclusiveEx(v2 + 16, 0i64);
    v6 = (_ETW_REG_ENTRY **)(v2 + 24);
    Flink = *v6;
    while( Flink != (_ETW_REG_ENTRY *)v6 )
    {
      v9 = (_ETW_REG_ENTRY **)Flink;
      Flink = (_ETW_REG_ENTRY *)Flink->RegList.Flink;
      if( v9[3] == RegEntry )
      {
        if( (_ETW_REG_ENTRY **)Flink->RegList.Blink != v9
          || (v10 = (_ETW_REG_ENTRY ***)v9[1], *v10 != v9)
          || (*v10 = (_ETW_REG_ENTRY **)Flink,
              Flink->RegList.Blink = (_LIST_ENTRY *)v10,
              v11 = P[0],
              *((PVOID **)P[0] + 1) != P) )
        {
LABEL_15:
          __fastfail(3u);
        }
        *v9 = (_ETW_REG_ENTRY *)P[0];
        v9[1] = (_ETW_REG_ENTRY *)P;
        v11[1] = v9;
        P[0] = v9;
      }
    }
    ExReleasePushLockEx(v5, 0i64);
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
    while( 1 )
    {
      v8 = (volatile INT32 **)P[0];
      if( P[0] == P )
        break;
      if( *((PVOID **)P[0] + 1) != P )
        goto LABEL_15;
      v12 = *(_QWORD *)P[0];
      if( *(PVOID *)(*(_QWORD *)P[0] + 8i64) != P[0] )
        goto LABEL_15;
      P[0] = *(PVOID *)P[0];
      *(_QWORD *)(v12 + 8) = P;
      EtwpUnreferenceDataBlock(v8[2]);
      EtwpReleaseQueueEntry(v8, 1);
    }
  }
}

Referenced by: