EtwpDisallowedGuidAddition

VOID __stdcall EtwpDisallowedGuidAddition(_GUID *Guid, PVOID NotificationContext){
  _WMI_LOGGER_CONTEXT *v2; 
  _ETW_GUID_ENTRY *GuidEntryByGuid; 
  _ETW_GUID_ENTRY *v5; 
  _ETHREAD *CurrentThread; 
  UINT64 p_Lock; 
  int v8; 
  _ETWP_NOTIFICATION_HEADER *v9; 
  __int64 v10; 
  _LIST_ENTRY *Flink; 
  _ETW_GUID_ENTRY *v12; 
  unsigned __int8 v13; 
  _ETW_REG_ENTRY *v14; 
  _ETW_REG_ENTRY *v15; 
  INT64 v16; 
  _ETW_GUID_ENTRY *GroupEntry; 
  unsigned __int8 v18; 
  unsigned __int8 v19; 
  UINT8 v20; 
  volatile INT32 *v21; 
  CHAR updated; 
  _ETHREAD *v23; 
  INT64 v24; 
  _ETW_REG_ENTRY *RegEntry; 
  CHAR v27; 
  _ETWP_NOTIFICATION_HEADER *DataBlock; 
  DataBlock = 0i64;
  v2 = (_WMI_LOGGER_CONTEXT *)NotificationContext;
  GuidEntryByGuid = EtwpFindGuidEntryByGuid(
                      *((_ETW_SILODRIVERSTATE **)NotificationContext + 135),
                      Guid,
                      EtwTraceGuidType);
  v5 = GuidEntryByGuid;
  if( GuidEntryByGuid )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 242);
    p_Lock = (UINT64)&GuidEntryByGuid->Lock;
    ExAcquirePushLockExclusiveEx((UINT64)&GuidEntryByGuid->Lock, 0i64);
    v5->LockOwner = (_ETHREAD *)KeGetCurrentThread();
    v8 = EtwpBuildNotificationPacket((__int64)v5, 0i64, 0, (__int64 *)&DataBlock);
    v9 = DataBlock;
    if( !v8 )
    {
      DataBlock->NotificationType = EtwNotificationTypeEnable;
      v9->DestinationGuid = *Guid;
      v9->SourcePID = (unsigned int)PsGetCurrentThreadProcessId();
      if( EtwpIsGuidAllowed(v2, Guid) != 1 )
      {
        v10 = 0i64;
        if( !v5->HostEntry )
        {
          Flink = v5->SiloGuidList.Flink;
          if( Flink != &v5->SiloGuidList )
            v10 = (__int64)&Flink[-1];
        }
        v12 = v5;
        v13 = 0;
        while( 1 )
        {
          v14 = (_ETW_REG_ENTRY *)v12->RegListHead.Flink;
LABEL_27:
          while( v14 != (_ETW_REG_ENTRY *)&v12->RegListHead )
          {
            v15 = v14;
            RegEntry = v14;
            v16 = (INT64)v14;
            v14 = (_ETW_REG_ENTRY *)v14->RegList.Flink;
            GroupEntry = v15->GroupEntry;
            if( GroupEntry )
            {
              if( v13 )
                GroupEntry = GroupEntry->HostEntry;
              v18 = *(&v15->GroupEnableMask + 2 * v13);
              if( v18 )
              {
                v19 = 0;
                while( !GroupEntry->EnableInfo[v19].IsEnabled || GroupEntry->EnableInfo[v19].LoggerId != *(_DWORD *)v2 )
                {
                  if( ++v19 >= 8u )
                    goto LABEL_27;
                }
                v20 = 1 << v19;
                if( 1 << v19 && (v18 & v20) != 0 )
                {
                  v21 = (volatile INT32 *)v9;
                  *(_BYTE *)(v16 + 2i64 * v13 + 101) = v18 & ~v20;
                  LODWORD(v24) = 0;
                  updated = EtwpCalculateUpdateNotification(v16, v20, v18, v18, 2, v13, v24, (CHAR **)&DataBlock);
                  v9 = DataBlock;
                  v27 = updated;
                  if( v21 != (volatile INT32 *)DataBlock )
                  {
                    if( DataBlock )
                    {
                      EtwpUnreferenceDataBlock(v21);
                      updated = v27;
                    }
                    else
                    {
                      v9 = (_ETWP_NOTIFICATION_HEADER *)v21;
                      DataBlock = (_ETWP_NOTIFICATION_HEADER *)v21;
                    }
                  }
                  if( updated )
                    EtwpSendDataBlock(RegEntry, v9);
                  v2 = (_WMI_LOGGER_CONTEXT *)NotificationContext;
                }
              }
            }
          }
          if( v12 != v5 )
          {
            v12->LockOwner = 0i64;
            ExReleasePushLockEx((UINT64)&v12->Lock, 0i64);
            KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
            v9 = DataBlock;
          }
          if( !v10 )
            break;
          v23 = (_ETHREAD *)KeGetCurrentThread();
          v13 = 1;
          v12 = (_ETW_GUID_ENTRY *)v10;
          --*((_WORD *)v23 + 242);
          ExAcquirePushLockExclusiveEx(v10 + 408, 0i64);
          *(_QWORD *)(v10 + 416) = KeGetCurrentThread();
          v10 = *(_QWORD *)(v10 + 16) - 16i64;
          if( (_ETW_GUID_ENTRY *)v10 == v5 )
            v10 = 0i64;
          v9 = DataBlock;
        }
        p_Lock = (UINT64)&v5->Lock;
      }
    }
    if( v9 )
      EtwpUnreferenceDataBlock((volatile INT32 *)v9);
    v5->LockOwner = 0i64;
    ExReleasePushLockEx(p_Lock, 0i64);
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
    EtwpUnreferenceGuidEntry(v5);
  }
}

Referenced by: