EtwpCovSampCaptureCancelApcs

NTSTATUS __fastcall EtwpCovSampCaptureCancelApcs(INT64 a1){
  UINT64 v1; 
  NTSTATUS result; 
  INT64 v3; 
  __int64 *v4; 
  UINT64 *v5; 
  void *v6; 
  unsigned __int8 v7; 
  unsigned __int64 v8; 
  INT64 v9; 
  INT64 v10; 
  result = *(_DWORD *)(a1 + 344);
  if( *(_DWORD *)(a1 + 348) != result )
  {
    v3 = a1 + 304;
    v4 = *(__int64 **)(a1 + 304);
    if( v4 != (__int64 *)(a1 + 304) )
    {
      v5 = (UINT64 *)(a1 + 264);
      do
      {
        v6 = 0i64;
        KeAcquireSpinLockRaiseToDpc(v5, v1);
        v8 = v7;
        if( *((_BYTE *)v4 + 114) )
        {
          v6 = (void *)v4[5];
          if( v6 )
            ObfReferenceObjectWithTag((PVOID)v4[5], 0x746C6644u);
        }
        KxReleaseSpinLock(v5);
        result = KiIrqlFlags;
        __writecr8(v8);
        if( v6 )
        {
          if( KeRemoveQueueApc((_KAPC *)(v4 + 4)) )
          {
            v9 = StartContext;
            memset((INT64)(v4 + 4), 0i64);
            v10 = v4[3];
            *((_DWORD *)v4 + 30) = 0;
            EtwpCovSampCaptureReleaseToLookaside(v9, v10, (struct _SLIST_ENTRY *)(v4 - 3));
          }
          result = ObfDereferenceObjectWithTag(v6, 0x746C6644ui64);
        }
        v4 = (__int64 *)*v4;
      }
      while( v4 != (__int64 *)v3 );
    }
  }
  return result;
}

Referenced by: