EtwpCheckProviderLoggingAccess

INT64 __fastcall EtwpCheckProviderLoggingAccess(INT64 a1, const GUID *a2, CHAR a3){
  unsigned int v4; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  if( !a3 || (*(_BYTE *)(a1 + 98) & 1) != 0 )
    return 0i64;
  SeCaptureSubjectContextEx(0i64, *(_EPROCESS **)(a1 + 80), &SubjectContext);
  v4 = EtwpCheckGuidAccess(a2, 0x200ui64, &SubjectContext);
  SeReleaseSubjectContext(&SubjectContext);
  return v4;
}

Referenced by: