EtwpNotifyGuid

NTSTATUS __stdcall EtwpNotifyGuid(
        _ETW_SILODRIVERSTATE *SiloState,
        _ETWP_NOTIFICATION_HEADER *DataBlock,
        INT8 RequestorMode){
  _ETW_GUID_TYPE v3; 
  __int64 NotificationSize; 
  int v9; 
  unsigned __int64 v10; 
  unsigned int v11; 
  unsigned int v12; 
  unsigned int TargetPID; 
  _ETW_GUID_ENTRY *GuidEntryByGuid; 
  _ETWP_NOTIFICATION_HEADER *v15; 
  _ETW_GUID_ENTRY *v16; 
  _ETW_REG_ENTRY *p_RegListHead; 
  NTSTATUS v18; 
  _ETW_REG_ENTRY *i; 
  unsigned __int16 Flags; 
  _ETWP_NOTIFICATION_HEADER *v21; 
  unsigned int ProcessId; 
  NTSTATUS v23; 
  PVOID v24; 
  bool v25; 
  unsigned int v26; 
  bool v27; 
  _ETWP_NOTIFICATION_HEADER *DataBlocka; 
  _ETWP_NOTIFICATION_HEADER *OutDataBlock; 
  _ETW_REG_ENTRY *RegEntryPtr; 
  INT64 a2; 
  PVOID Handle; 
  INT64 v33[18]; 
  UINT16 v34; 
  unsigned int v35; 

  v3 = EtwTraceGuidType;
  Handle = 0i64;
  RegEntryPtr = 0i64;
  OutDataBlock = 0i64;
  DataBlocka = 0i64;
  v35 = 0;
  v27 = 0;
  a2 = 0i64;
  memset(v33, 0i64, 0x58u);
  NotificationSize = DataBlock->NotificationSize;
  if( (unsigned int)NotificationSize > 0x10000 )
    return -1073741306;
  if( DataBlock->NotificationType == EtwNotificationTypeFilteredPrivateLogger )
  {
    if( (unsigned int)NotificationSize < 0x78
      || (v10 = (DataBlock->SourceGuid[1].Data1 + 7) & 0xFFFFFFF8, v10 >= NotificationSize - 76) )
    {
      v9 = -2147483643;
      goto LABEL_60;
    }
    v11 = *(unsigned int *)((char *)&DataBlock->SourceGuid[1].Data1 + v10);
    if( v11 )
    {
      a2 = (INT64)&DataBlock->SourceGuid[1].Data2 + v10;
      if( EtwpValidateTraceControlFilterDescriptors(v11, a2, (unsigned int)(NotificationSize - (v10 + 76)), (INT64)v33) )
      {
        v9 = -1073741811;
        goto LABEL_60;
      }
    }
    DataBlock->NotificationType = EtwNotificationTypePrivateLogger;
  }
  DataBlock->SourcePID = (unsigned int)PsGetCurrentThreadProcessId();
  if( DataBlock->NotificationType == EtwNotificationTypePrivateLogger )
  {
    if( DataBlock->NotificationSize < 0xF8 )
    {
      v9 = -1073741789;
      goto LABEL_60;
    }
    v12 = 128;
    v27 = EtwpCheckCurrentUserGuidAccess((_GUID *)&unk_1400105C8, 0x80ui64) < 0;
    DataBlock->DestinationGuid = (_GUID)PrivateLoggerNotificationGuid;
  }
  else
  {
    v12 = 4;
    v3 = EtwNotificationGuidType;
  }
  TargetPID = DataBlock->TargetPID;
  DataBlock->ReplyCount = 0;
  v26 = TargetPID;
  GuidEntryByGuid = EtwpFindGuidEntryByGuid(SiloState, &DataBlock->DestinationGuid, v3);
  v15 = 0i64;
  v16 = GuidEntryByGuid;
  if( !GuidEntryByGuid )
  {
    v9 = -1073741163;
    goto LABEL_60;
  }
  if( RequestorMode )
  {
    if( DataBlock->NotificationType != EtwNotificationTypePrivateLogger )
    {
      v9 = EtwpAccessCheck(GuidEntryByGuid->SecurityDescriptor, v12, 0i64);
      if( v9 < 0 )
        goto LABEL_59;
    }
  }
  KeEnterCriticalRegion();
  ExAcquirePushLockExclusiveEx(&v16->Lock, 0i64);
  p_RegListHead = (_ETW_REG_ENTRY *)&v16->RegListHead;
  v16->LockOwner = (_ETHREAD *)KeGetCurrentThread();
  if( (_ETW_REG_ENTRY *)p_RegListHead->RegList.Flink == p_RegListHead )
  {
    v9 = -1073741162;
    goto LABEL_53;
  }
  if( DataBlock->ReplyRequested )
  {
    v9 = EtwpCreateUmReplyObject(v16, &Handle, &RegEntryPtr);
    if( v9 < 0 )
      goto LABEL_53;
    DataBlock->ReplyHandle = (unsigned __int64)RegEntryPtr;
  }
  v18 = EtwpAllocDataBlock(DataBlock->NotificationSize, DataBlock, &OutDataBlock);
  if( v18 < 0 )
  {
LABEL_27:
    v9 = -1073741801;
    goto LABEL_53;
  }
  for( i = (_ETW_REG_ENTRY *)p_RegListHead->RegList.Flink; i != p_RegListHead; i = (_ETW_REG_ENTRY *)i->RegList.Flink )
  {
    Flags = i->Flags;
    v21 = OutDataBlock;
    if( (Flags & 2) == 0
      || (Flags & 0x40) != 0
      || a2 && !EtwpApplyTransientFilters(i, a2, v33[10], (_ETW_FILTER_STRING_TOKEN **)v33)
      || v26 && (unsigned int)PsGetProcessId(i->Process) != v26
      || v27 && (v18 = EtwpCheckCurrentUserProcessAccess(i->Process), v18 < 0) )
    {
      v15 = 0i64;
    }
    else
    {
      if( DataBlock->NotificationType == EtwNotificationTypePrivateLogger )
      {
        v34 = 0;
        if( *(_DWORD *)&DataBlock->SourceGuid[1].Data2 != 1 )
        {
          ProcessId = (unsigned int)PsGetProcessId(i->Process);
          v15 = 0i64;
          v18 = EtwpDemuxPrivateTraceHandle(
                  (PLEARNING_MODE_DATA *)ProcessId,
                  *(_WORD *)DataBlock->SourceGuid[1].Data4 & 0x7FFF,
                  &v34);
          if( v18 < 0 )
            continue;
          v15 = DataBlocka;
          if( DataBlocka )
          {
            EtwpUnreferenceDataBlock(DataBlocka);
            v15 = 0i64;
            DataBlocka = 0i64;
          }
          v18 = EtwpAllocDataBlock(DataBlock->NotificationSize, DataBlock, &DataBlocka);
          if( v18 < 0 )
            goto LABEL_27;
          v21 = DataBlocka;
          *(_WORD *)DataBlocka->SourceGuid[1].Data4 = v34;
        }
      }
      v23 = EtwpSendDataBlock(i, v21);
      v15 = 0i64;
      if( v23 < 0 )
        v18 = v23;
      else
        ++v35;
    }
  }
  v9 = 0;
  v24 = Handle;
  v25 = v35 == 0;
  DataBlock->ReplyCount = v35;
  if( v25 )
    v9 = v18;
  DataBlock->ReplyHandle = (unsigned __int64)v24;
LABEL_53:
  v16->LockOwner = (_ETHREAD *)v15;
  ExReleasePushLockEx((_DWORD)v16 + 408, 0);
  KeLeaveCriticalRegion();
  if( OutDataBlock )
    EtwpUnreferenceDataBlock(OutDataBlock);
  if( DataBlocka )
    EtwpUnreferenceDataBlock(DataBlocka);
  if( RegEntryPtr )
    HalPutDmaAdapter((PADAPTER_OBJECT)RegEntryPtr);
LABEL_59:
  EtwpUnreferenceGuidEntry(v16);
LABEL_60:
  EtwpFreeFilterInfo((_ETW_FILTER_INFO *)v33);
  return v9;
}

Referenced by: