EtwpTraceImageUnloadApc

NTSTATUS __stdcall EtwpTraceImageUnloadApc(PVOID P){
  int v2; 
  INT64 *v3; 
  NTSTATUS result; 
  INT64 v5; 
  INT64 v6; 
  INT64 v7; 
  INT64 v8[2]; 
  __int64 v9; 
  v9 = 0i64;
  *(_OWORD *)v8 = 0i64;
  if( KeAreAllApcsDisabled() )
    __int2c();
  if( FltMgrCallbacks )
    v2 = (*(__int64(__fastcall **)(_QWORD, __int64, INT64 *, __int64 *))(FltMgrCallbacks + 24))(
           *((_QWORD *)P + 11),
           1024i64,
           v8,
           &v9);
  else
    v2 = -1073741637;
  if( v2 < 0 )
    v3 = (INT64 *)(*((_QWORD *)P + 11) + 88i64);
  else
    v3 = v8;
  LODWORD(v7) = 0;
  LODWORD(v6) = *((_DWORD *)P + 31);
  LODWORD(v5) = *((_DWORD *)P + 30);
  EtwpTraceImageUnload(
    (INT64)v3,
    *((_QWORD *)P + 12),
    *((_QWORD *)P + 13),
    *((_QWORD *)P + 14),
    v5,
    v6,
    *((_DWORD *)P + 32),
    *((_DWORD *)P + 33),
    *((_QWORD *)P + 17),
    v7);
  if( v9 )
    (*(void(**)(void))(FltMgrCallbacks + 32))();
  ObfDereferenceObjectWithTag(*((PVOID *)P + 11), 0x746C6644ui64);
  ExFreePoolWithTag(P, 0);
  return result;
}

Referenced by: