MiArbitraryCodeBlocked

NTSTATUS __stdcall MiArbitraryCodeBlocked(_EPROCESS *CreatingProcess){
  _ETHREAD *CurrentThread; 
  unsigned int MitigationFlags; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  MitigationFlags = CreatingProcess->MitigationFlags;
  if( (MitigationFlags & 0x100) == 0 || (CurrentThread->CrossThreadFlags & 0x40000) != 0 )
  {
    if( (MitigationFlags & 0x800) != 0 && (CurrentThread->CrossThreadFlags & 0x40000) == 0 )
      EtwTimLogProhibitDynamicCode(1i64, (INT64)CreatingProcess);
    EtwTraceMemoryAcg(0i64);
    return 0;
  }
  else
  {
    EtwTraceMemoryAcg(0x80000000ui64);
    EtwTimLogProhibitDynamicCode(2i64, (INT64)CreatingProcess);
    return -1073740284;
  }
}

Referenced by: