EtwpRegisterUMGuid
HRESULT __stdcall EtwpRegisterUMGuid(
STRSAFE_LPWSTR pszDest,
SIZE_T cchDest,
SIZE_T *pcchNewDestLength,
STRSAFE_PCNZWCH pszSrc,
SIZE_T cchToCopy){
int v6;
char v7;
unsigned int v8;
bool v9;
__int64 v10;
void *GuidEntryByGuid;
VOID *v13;
HRESULT v14;
_ETHREAD *v15;
_DWORD *v16;
int SchematizedFilterSize;
unsigned int v18;
PADAPTER_OBJECT v19;
char Size;
INT64 v21;
char v22;
UINT8 v23;
__int64 v24;
_DWORD *v25;
int v26;
EVENT_DESCRIPTOR *v27;
UINT64 v28;
_GUID *v29;
__int64 v30;
int v32;
_ETHREAD *CurrentThread;
char v34;
UINT64 PreviouslyGrantedAccess;
char v36[4];
INT64 GrantedAccess;
int v38;
PADAPTER_OBJECT DmaAdapter;
__int64 v40;
struct _SECURITY_SUBJECT_CONTEXT SubjectContext;
__int64 v42;
v6 = *(_DWORD *)(cchDest + 16);
v38 = *(_DWORD *)(cchDest + 20);
v7 = (char)pszSrc;
v8 = (unsigned int)pcchNewDestLength;
v10 = *(_QWORD *)cchDest - SecurityProviderGuid;
v9 = *(_QWORD *)cchDest == (_QWORD)SecurityProviderGuid;
v40 = 0i64;
DmaAdapter = 0i64;
LOBYTE(v42) = 0;
if( v9 )
v10 = *(_QWORD *)(cchDest + 8) - *((_QWORD *)&SecurityProviderGuid + 1);
if( !v10 )
return -1073741790;
GuidEntryByGuid = EtwpFindGuidEntryByGuid(
(_ETW_SILODRIVERSTATE *)pszDest,
(const _GUID *)cchDest,
(_ETW_GUID_TYPE)((unsigned int)(v6 - 2) > 1));
if( !GuidEntryByGuid )
{
GuidEntryByGuid = EtwpAddGuidEntry((INT64)pszDest, cchDest, (unsigned int)(v6 - 2) > 1);
if( !GuidEntryByGuid )
return -1073741801;
}
v13 = (VOID *)*((_QWORD *)GuidEntryByGuid + 9);
GrantedAccess = 0i64;
memset(&SubjectContext, 0, sizeof(SubjectContext));
SeCaptureSubjectContext(&SubjectContext);
LODWORD(PreviouslyGrantedAccess) = 0;
SeAccessCheck(
v13,
&SubjectContext,
0,
0x800ui64,
PreviouslyGrantedAccess,
0i64,
(GENERIC_MAPPING *)&EtwpGenericMapping,
1,
(UINT64 *)((char *)&GrantedAccess + 4),
&GrantedAccess);
SeReleaseSubjectContext(&SubjectContext);
v14 = GrantedAccess;
if( (int)GrantedAccess >= 0 )
{
if( *((_QWORD *)GuidEntryByGuid + 50) )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
ExAcquirePushLockExclusiveEx(*((_QWORD *)GuidEntryByGuid + 50) + 408i64, 0i64);
*(_QWORD *)(*((_QWORD *)GuidEntryByGuid + 50) + 416i64) = KeGetCurrentThread();
}
v15 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v15 + 242);
ExAcquirePushLockExclusiveEx((UINT64)GuidEntryByGuid + 408, 0i64);
v16 = (_DWORD *)cchToCopy;
*((_QWORD *)GuidEntryByGuid + 52) = KeGetCurrentThread();
*v16 = 160;
SchematizedFilterSize = EtwpGetSchematizedFilterSize((_ETW_GUID_ENTRY *)GuidEntryByGuid, 0xFFu);
v18 = 160;
if( SchematizedFilterSize )
{
v18 = SchematizedFilterSize + 176;
*v16 = SchematizedFilterSize + 176;
}
if( v18 > v8 )
{
v14 = -1073741789;
}
else
{
v14 = EtwpAddUmRegEntry((ULONG_PTR)GuidEntryByGuid, (__int64)&DmaAdapter, (__int64)&v40);
if( v14 >= 0 )
{
if( v7 )
_InterlockedOr16((volatile signed __int16 *)&DmaAdapter[6].Size, 0x100u);
v19 = DmaAdapter;
*(_QWORD *)(cchDest + 24) = v40;
if( *((_DWORD *)GuidEntryByGuid + 24) )
EtwpUpdateEnableMask((INT64)GuidEntryByGuid, (v19[6].Size & 8) != 0, 0, 1, (BYTE *)&v19[6].Size + 2);
Size = v19[6].Size;
v36[0] = *((_BYTE *)&v19[6].Size + 2);
EtwpApplyScopeFilters((INT64)v19, (Size & 8) != 0, 0, 0, (BYTE *)v36);
v21 = *((_QWORD *)GuidEntryByGuid + 50);
if( v21 )
{
if( *(_DWORD *)(v21 + 96) )
EtwpUpdateEnableMask(v21, (v19[6].Size & 8) != 0, 1, 1, (BYTE *)&v19[6].Size + 4);
v34 = v19[6].Size;
LOBYTE(v42) = *((_BYTE *)&v19[6].Size + 4);
EtwpApplyScopeFilters((INT64)v19, (v34 & 8) != 0, 0, 1, (BYTE *)&v42);
}
if( (v19[6].Size & 8) != 0 )
{
*((_BYTE *)&v19[6].Size + 2) = v36[0];
v22 = v42;
*((_BYTE *)&v19[6].Size + 4) = v42;
}
else
{
*((_BYTE *)&v19[6].Size + 2) &= v36[0];
*((_BYTE *)&v19[6].Size + 4) &= v42;
v22 = *((_BYTE *)&v19[6].Size + 4);
}
v23 = *((_BYTE *)&v19[6].Size + 2);
if( v23 || v22 )
{
EtwpComputeRegEntryEnableInfo((_ETW_REG_ENTRY *)v19, (_TRACE_ENABLE_INFO *)(cchDest + 112));
v32 = *((_BYTE *)GuidEntryByGuid + 91) & 1;
BYTE3(v42) = 0;
*(_DWORD *)(cchDest + 152) = v32;
LOWORD(v42) = *((_WORD *)GuidEntryByGuid + 44);
BYTE2(v42) = *((_BYTE *)GuidEntryByGuid + 90);
HIDWORD(v42) = *((_DWORD *)GuidEntryByGuid + 20);
v24 = v42;
}
else
{
v24 = 0i64;
*(_OWORD *)(cchDest + 112) = 0i64;
*(_OWORD *)(cchDest + 128) = 0i64;
*(_DWORD *)(cchDest + 152) = 0;
}
v25 = (_DWORD *)cchToCopy;
*(_QWORD *)(cchDest + 144) = v24;
*v25 = 160;
v26 = EtwpGetSchematizedFilterSize((_ETW_GUID_ENTRY *)GuidEntryByGuid, v23);
if( v26 )
{
*v25 = v26 + 176;
*(_DWORD *)(cchDest + 168) = v26;
*(_DWORD *)(cchDest + 172) = 0x80000000;
*(_QWORD *)(cchDest + 160) = 136i64;
EtwpCopySchematizedFilters((_EVENT_FILTER_HEADER *)(cchDest + 176), (_ETW_GUID_ENTRY *)GuidEntryByGuid, v23);
v26 = 1;
}
*(_DWORD *)(cchDest + 156) = v26;
*(_DWORD *)(cchDest + 44) = *v25;
EtwpTrackProviderRegistration((INT64)v19);
if( EtwEventEnabled(EtwpEventTracingProvRegHandle, (EVENT_DESCRIPTOR *)&ETW_EVENT_PROVIDER_REGISTER, v27) )
EtwpEventWriteTemplateSessAndProv(
v28,
(_EVENT_DESCRIPTOR *)&ETW_EVENT_PROVIDER_REGISTER,
v29,
1u,
0i64,
(_GUID *)cchDest);
}
}
*((_QWORD *)GuidEntryByGuid + 52) = 0i64;
ExReleasePushLockEx((UINT64)GuidEntryByGuid + 408, 0i64);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
v30 = *((_QWORD *)GuidEntryByGuid + 50);
if( v30 )
{
*(_QWORD *)(v30 + 416) = 0i64;
ExReleasePushLockEx(*((_QWORD *)GuidEntryByGuid + 50) + 408i64, 0i64);
KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
}
if( DmaAdapter )
HalPutDmaAdapter(DmaAdapter);
}
EtwpUnreferenceGuidEntry(GuidEntryByGuid);
return v14;
}Referenced by:
NtTraceControl