EtwpCoverageSamplerStop

VOID __fastcall EtwpCoverageSamplerStop(INT64 a1){
  _ETHREAD *CurrentThread; 
  struct _DMA_ADAPTER *v2; 
  int v4; 
  _ETHREAD *v5; 
  _ETHREAD *v6; 
  union SLIST_HEADER *v7; 
  int v8; 
  INT64 v9; 
  void *i; 
  INT64 v11; 
  _ETHREAD *v12; 
  __int64 NextProcess; 
  void *v14; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v2 = 0i64;
  --*((_WORD *)CurrentThread + 242);
  ExAcquirePushLockExclusiveEx((UINT64)&EtwpCovSampGlobals, 0i64);
  qword_140C196A8 = (__int64)KeGetCurrentThread();
  if( qword_140C196B8 == a1 )
  {
    v4 = *(_DWORD *)(a1 + 1216);
    if( (v4 & 2) == 0 )
    {
      *(_DWORD *)(a1 + 1216) = v4 | 2;
      qword_140C196A8 = 0i64;
      if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&EtwpCovSampGlobals, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock((volatile INT64 *)&EtwpCovSampGlobals);
      KeAbPostRelease(&EtwpCovSampGlobals);
      KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
      ExWaitForRundownProtectionRelease((EX_RUNDOWN_REF *)&stru_140C196C0);
      ExRundownCompleted((EX_RUNDOWN_REF *)&stru_140C196C0);
      v5 = (_ETHREAD *)KeGetCurrentThread();
      --*((_WORD *)v5 + 242);
      ExAcquirePushLockExclusiveEx((UINT64)&EtwpCovSampGlobals, 0i64);
      v6 = (_ETHREAD *)KeGetCurrentThread();
      v2 = (struct _DMA_ADAPTER *)qword_140C196B8;
      qword_140C196B8 = 0i64;
      v7 = (union SLIST_HEADER *)StartContext;
      qword_140C196A8 = (__int64)v6;
      v8 = *(_DWORD *)(a1 + 1148);
      if( (v8 & 8) != 0 )
      {
        KeStopProfile(StartContext + 16);
        *(_DWORD *)(a1 + 1148) &= ~8u;
        v8 = *(_DWORD *)(a1 + 1148);
      }
      if( (v8 & 2) != 0 )
      {
        PsRemoveLoadImageNotifyRoutine(EtwpCovSampImageNotify);
        *(_DWORD *)(a1 + 1148) &= ~2u;
        v8 = *(_DWORD *)(a1 + 1148);
      }
      if( (v8 & 4) != 0 )
      {
        v9 = EtwpHostSiloState;
        *(_DWORD *)(EtwpHostSiloState + 4552) &= 0xFFFFFDFB;
        *(_DWORD *)(v9 + 4548) &= 0xFFFFEFFB;
        EtwpUpdateGlobalGroupMasks(v9, 0i64, 9ui64);
        *(_DWORD *)(a1 + 1148) &= ~4u;
      }
      for( i = 0i64; ; i = v14 )
      {
        NextProcess = PsGetNextProcess(i);
        v14 = (void *)NextProcess;
        if( !NextProcess )
          break;
        v11 = *(_QWORD *)(NextProcess + 2544);
        if( v11 )
        {
          v12 = (_ETHREAD *)KeGetCurrentThread();
          --*((_WORD *)v12 + 242);
          ExAcquirePushLockExclusiveEx(v11 + 8, 0i64);
          *(_QWORD *)(v11 + 16) = KeGetCurrentThread();
          EtwpCovSampProcessCleanup(v11, 1);
          *(_QWORD *)(v11 + 16) = 0i64;
          if( (_InterlockedExchangeAdd64((volatile signed __int64 *)(v11 + 8), 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
            ExfTryToWakePushLock((volatile INT64 *)(v11 + 8));
          KeAbPostRelease((PVOID)(v11 + 8));
          KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
        }
      }
      EtwpCovSampCaptureContextStop(v7);
      *(_DWORD *)(a1 + 1148) &= ~1u;
    }
  }
  if( (struct _KTHREAD *)qword_140C196A8 == KeGetCurrentThread() )
  {
    qword_140C196A8 = 0i64;
    if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&EtwpCovSampGlobals, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((volatile INT64 *)&EtwpCovSampGlobals);
    KeAbPostRelease(&EtwpCovSampGlobals);
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  }
  if( v2 )
    HalPutDmaAdapter(v2);
}

Referenced by: