EtwpDisallowedGuidRemoval

VOID __stdcall EtwpDisallowedGuidRemoval(const _GUID *Guid, VOID *NotificationContext){
  _WMI_LOGGER_CONTEXT *v2; 
  _ETW_GUID_ENTRY *GuidEntryByGuid; 
  _ETW_GUID_ENTRY *v5; 
  _ETHREAD *CurrentThread; 
  ULONG_PTR v7; 
  NTSTATUS v8; 
  _ETWP_NOTIFICATION_HEADER *v9; 
  _GUID *v10; 
  _EX_PUSH_LOCK *p_Lock; 
  _ETW_GUID_ENTRY *Flink; 
  _ETW_GUID_ENTRY *v13; 
  unsigned __int8 v14; 
  _ETW_REG_ENTRY *v15; 
  int v16; 
  _ETW_REG_ENTRY *p_RegListHead; 
  _ETW_REG_ENTRY *v18; 
  _ETW_REG_ENTRY *v19; 
  _ETW_GUID_ENTRY *GroupEntry; 
  UINT64 v21; 
  unsigned __int8 v22; 
  UINT8 v23; 
  UINT8 v24; 
  _ETW_REG_ENTRY *v25; 
  _ETWP_NOTIFICATION_HEADER *v26; 
  UINT8 updated; 
  _ETHREAD *v28; 
  UINT64 ControlCode; 
  _ETWP_NOTIFICATION_HEADER **NotificationBlockPtr; 
  _ETW_GUID_ENTRY *v31; 
  int RegEntry; 
  _ETW_REG_ENTRY *RegEntrya; 
  UINT8 RegEntryb; 
  _ETWP_NOTIFICATION_HEADER *NotificationPacket; 

  NotificationPacket = 0i64;
  v2 = (_WMI_LOGGER_CONTEXT *)NotificationContext;
  LOBYTE(RegEntry) = 0;
  GuidEntryByGuid = EtwpFindGuidEntryByGuid(
                      *((_ETW_SILODRIVERSTATE **)NotificationContext + 135),
                      Guid,
                      EtwTraceGuidType);
  v31 = GuidEntryByGuid;
  v5 = GuidEntryByGuid;
  if( GuidEntryByGuid )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    v7 = (_DWORD)GuidEntryByGuid + 408;
    ExAcquirePushLockExclusiveEx(&GuidEntryByGuid->Lock, 0i64);
    v5->LockOwner = (_ETHREAD *)KeGetCurrentThread();
    v8 = EtwpBuildNotificationPacket(v5, 0i64, 0, &NotificationPacket);
    v9 = NotificationPacket;
    if( !v8 )
    {
      NotificationPacket->NotificationType = EtwNotificationTypeEnable;
      v9->DestinationGuid = *Guid;
      v9->SourcePID = (unsigned int)PsGetCurrentThreadProcessId();
      if( EtwpIsGuidAllowed(v2, Guid, v10) == 1 )
      {
        p_Lock = 0i64;
        if( !v5->HostEntry )
        {
          Flink = (_ETW_GUID_ENTRY *)v5->SiloGuidList.Flink;
          if( Flink != (_ETW_GUID_ENTRY *)&v5->SiloGuidList )
            p_Lock = &Flink[-1].Lock;
        }
        v13 = v5;
        v14 = 0;
        while( 1 )
        {
          v15 = (_ETW_REG_ENTRY *)v13->RegListHead.Flink;
          if( v15 != (_ETW_REG_ENTRY *)&v13->RegListHead )
          {
            v16 = RegEntry;
            p_RegListHead = (_ETW_REG_ENTRY *)&v13->RegListHead;
            do
            {
              v18 = v15;
              RegEntrya = v15;
              v19 = v15;
              v15 = (_ETW_REG_ENTRY *)v15->RegList.Flink;
              GroupEntry = v18->GroupEntry;
              if( GroupEntry )
              {
                if( v14 )
                  GroupEntry = GroupEntry->HostEntry;
                v21 = v14;
                if( GroupEntry->ProviderEnableInfo.IsEnabled )
                {
                  v22 = 0;
                  while( !GroupEntry->EnableInfo[v22].IsEnabled || GroupEntry->EnableInfo[v22].LoggerId != v2->LoggerId )
                  {
                    if( ++v22 >= 8u )
                      goto LABEL_20;
                  }
                  v16 = 1;
                  LOBYTE(v16) = 1 << v22;
LABEL_20:
                  if( (_BYTE)v16 )
                  {
                    v23 = *(&v18->GroupEnableMask + 2 * v14);
                    LOBYTE(v21) = 2;
                    LODWORD(ControlCode) = 1;
                    EtwpUpdateRegEntryEnableMask(v19, (UINT8)v2, v16, v21);
                    v24 = v23;
                    v25 = RegEntrya;
                    LODWORD(NotificationBlockPtr) = 1;
                    LOBYTE(ControlCode) = v14;
                    v26 = v9;
                    updated = EtwpCalculateUpdateNotification(
                                RegEntrya,
                                v16,
                                v24,
                                0,
                                2u,
                                ControlCode,
                                NotificationBlockPtr);
                    v9 = NotificationPacket;
                    RegEntryb = updated;
                    if( v26 != NotificationPacket )
                    {
                      if( NotificationPacket )
                      {
                        EtwpUnreferenceDataBlock(v26);
                        updated = RegEntryb;
                      }
                      else
                      {
                        v9 = v26;
                        NotificationPacket = v26;
                      }
                    }
                    if( updated )
                      EtwpSendDataBlock(v25, v9);
                    v2 = (_WMI_LOGGER_CONTEXT *)NotificationContext;
                  }
                  p_RegListHead = (_ETW_REG_ENTRY *)&v13->RegListHead;
                }
              }
            }
            while( v15 != p_RegListHead );
            RegEntry = v16;
            v5 = v31;
          }
          if( v13 != v5 )
          {
            v13->LockOwner = 0i64;
            ExReleasePushLockEx((_DWORD)v13 + 408, 0);
            KeLeaveCriticalRegionThread(KeGetCurrentThread());
            v9 = NotificationPacket;
          }
          if( !p_Lock )
            break;
          v28 = (_ETHREAD *)KeGetCurrentThread();
          v14 = 1;
          v13 = (_ETW_GUID_ENTRY *)p_Lock;
          --v28->Tcb.KernelApcDisable;
          ExAcquirePushLockExclusiveEx(p_Lock + 51, 0i64);
          p_Lock[52]._bf_0 = (__int64)KeGetCurrentThread();
          p_Lock = (_EX_PUSH_LOCK *)(p_Lock[2]._bf_0 - 16);
          if( p_Lock == (_EX_PUSH_LOCK *)v5 )
            p_Lock = 0i64;
          v9 = NotificationPacket;
        }
        v7 = (_DWORD)v5 + 408;
      }
    }
    if( v9 )
      EtwpUnreferenceDataBlock(v9);
    v5->LockOwner = 0i64;
    ExReleasePushLockEx(v7, 0);
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
    EtwpUnreferenceGuidEntry(v5);
  }
}

Referenced by: