EtwpGetSecurityDescriptorByGuid
UINT8 __stdcall EtwpGetSecurityDescriptorByGuid(const _GUID *Guid, VOID **SecurityDescriptor){
_UNICODE_STRING DestinationString;
WCHAR pszDest[40];
DestinationString = 0i64;
RtlStringCbPrintfW(pszDest, 0x4Cui64, (WCHAR *)L"%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x");
RtlInitUnicodeString(&DestinationString, pszDest);
EtwpGetGuidSecurityDescriptor(&DestinationString, SecurityDescriptor);
if( *SecurityDescriptor )
return 1;
*SecurityDescriptor = (VOID *)*(&stru_140CF2E80 + 656);
return 0;
}Referenced by:
EtwpAccessCheckFromState
EtwpAllocGuidEntry
EtwpCheckGuidAccess
EtwpStartLogger
EtwpUpdateTrace