EtwpGetNextGuidEntry

volatile INT64 *__fastcall EtwpGetNextGuidEntry(INT64 a1, volatile INT64 *a2, INT64 a3){
  INT64 v3; 
  volatile INT64 *v4; 
  char v5; 
  volatile INT64 *v6; 
  INT64 v7; 
  _ETW_GUID_ENTRY **v8; 
  INT64 *v9; 
  __int64 i; 
  _ETHREAD *CurrentThread; 
  _ETW_GUID_ENTRY **v12; 
  _ETW_GUID_ENTRY *j; 
  v3 = a1 + 464;
  v4 = a2;
  v5 = 0;
  v6 = 0i64;
  if( a2 )
    v7 = v3
       + 56i64
       * (((unsigned __int8)*((_DWORD *)a2 + 10) ^ (unsigned __int8)(*((_DWORD *)a2 + 11) ^ *((_DWORD *)a2 + 12) ^ *((_DWORD *)a2 + 13))) & 0x3F);
  else
    v7 = a1 + 464;
  v8 = (_ETW_GUID_ENTRY **)(v7 + 16i64 * (int)a3);
  v9 = (INT64 *)(v7 + 48);
  for( i = 2 * ((int)a3 - 3i64); ; v8 = (_ETW_GUID_ENTRY **)&v9[i] )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 242);
    ExAcquirePushLockSharedEx((UINT64)v9, 0i64);
    v12 = v8;
    if( v4 )
      v12 = (_ETW_GUID_ENTRY **)v4;
    for( j = *v12; j != (_ETW_GUID_ENTRY *)v8; j = (_ETW_GUID_ENTRY *)j->GuidList.Flink )
    {
      v6 = (volatile INT64 *)j;
      if( EtwpReferenceGuidEntry(j) )
      {
        v5 = 1;
        break;
      }
    }
    if( _InterlockedCompareExchange64(v9, 0i64, 17i64) != 17 )
      ExfReleasePushLockShared(v9);
    KeAbPostRelease(v9);
    KeLeaveCriticalRegion();
    if( v4 )
      EtwpUnreferenceGuidEntry((PVOID)v4);
    if( v5 )
      return v6;
    v9 += 7;
    if( v9 == (INT64 *)(v3 + 3632) )
      break;
    v4 = 0i64;
  }
  return 0i64;
}

Referenced by: