EtwpValidateEnableNotification

NTSTATUS __stdcall EtwpValidateEnableNotification(
        _ETW_SILODRIVERSTATE *SiloState,
        _ETW_ENABLE_NOTIFICATION_PACKET *EnableNotificationPacket,
        INT8 RequestorMode,
        _ETW_SESSION_INFO *SessionInfo,
        _WMI_LOGGER_CONTEXT **LoggerContextPtr,
        _ETW_FILTER_INFO *FilterInfo){
  UINT64 LoggerId; 
  int v11; 
  __int64 v12; 
  _WMI_LOGGER_CONTEXT *v13; 
  _WMI_LOGGER_CONTEXT *v14; 
  bool v15; 
  unsigned int LoggerMode; 
  NTSTATUS v17; 
  unsigned int EnableProperty; 
  char v19; 
  int v20; 
  unsigned int v21; 
  NTSTATUS result; 

  *LoggerContextPtr = 0i64;
  if( *(_DWORD *)&EnableNotificationPacket->gap0[4] < 0x78u
    || EnableNotificationPacket->FilterCount && EtwpValidateFilterDescriptors(EnableNotificationPacket, FilterInfo)
    || EnableNotificationPacket->EnableInfo.IsEnabled > 2 )
  {
    return -1073741811;
  }
  LoggerId = EnableNotificationPacket->EnableInfo.LoggerId;
  v11 = EnableNotificationPacket->EnableInfo.LoggerId & 0x8000;
  SessionInfo->PrivateSession = v11 != 0;
  if( v11 )
  {
    EnableProperty = EnableNotificationPacket->EnableInfo.EnableProperty;
    if( (EnableProperty & 0x20) == 0 && (EnableProperty & 0x400) == 0 )
    {
      v17 = 0;
      goto LABEL_20;
    }
    return -1073741811;
  }
  if( (_DWORD)LoggerId == 3 )
    return -1073741790;
  v12 = PrivateLoggerNotificationGuid - *(_QWORD *)&EnableNotificationPacket->gap0[40];
  if( (_QWORD)PrivateLoggerNotificationGuid == *(_QWORD *)&EnableNotificationPacket->gap0[40] )
    v12 = *((_QWORD *)&PrivateLoggerNotificationGuid + 1) - *(_QWORD *)&EnableNotificationPacket->gap0[48];
  if( !v12 )
    return -1073741811;
  v13 = EtwpAcquireLoggerContextByLoggerId(SiloState, LoggerId, 0);
  v14 = v13;
  if( !v13 )
    goto LABEL_31;
  v15 = SiloState == (_ETW_SILODRIVERSTATE *)EtwpHostSiloState;
  *LoggerContextPtr = v13;
  if( !v15 && (EnableNotificationPacket->EnableInfo.EnableProperty & 0x400) != 0 )
    return -1073741811;
  if( (EnableNotificationPacket->EnableInfo.EnableProperty & 0x20) != 0 && (v13->LoggerMode & 0x1030800) != 0 )
    return -1073741811;
  if( (v13->Flags & 0x40) == 0 )
  {
    SessionInfo->SessionGuid = v13->InstanceGuid;
    LoggerMode = v13->LoggerMode;
    if( (LoggerMode & 0x80u) != 0 )
    {
      SessionInfo->SecureSession = 1;
      LoggerMode = v14->LoggerMode;
    }
    if( (LoggerMode & 0x1000000) != 0 )
      SessionInfo->PagedSession = 1;
    if( RequestorMode )
      v17 = EtwpCheckNotificationAccess((_GUID *)&EnableNotificationPacket->gap0[40], &SessionInfo->SessionGuid);
    else
      v17 = 0;
    goto LABEL_19;
  }
LABEL_31:
  v17 = -1073741162;
LABEL_19:
  EnableProperty = EnableNotificationPacket->EnableInfo.EnableProperty;
LABEL_20:
  v19 = EnableProperty;
  v20 = EnableProperty | 0x40;
  v21 = EnableProperty & 0xFFFFFFEF;
  if( (v19 & 0x10) == 0 )
    v21 = v20;
  result = v17;
  EnableNotificationPacket->EnableInfo.EnableProperty = v21;
  return result;
}

Referenced by: