WmiSetNetworkNotify
NTSTATUS __stdcall WmiSetNetworkNotify(VOID *NotifyRoutine){
int v1;
VOID *Buffer;
UINT64 DeviceCount;
_WMIP_TRACE_DEVICE *DeviceList;
Buffer = NotifyRoutine;
DeviceList = 0i64;
LODWORD(DeviceCount) = 0;
v1 = WmipBuildTraceDeviceList(0x200000ui64, &DeviceList, &DeviceCount);
if( v1 >= 0 )
{
v1 = WmipSendWmiIrpToTraceDeviceList(DeviceList, (unsigned int)DeviceCount, 0xAu, 8ui64, &Buffer);
if( v1 >= 0 )
v1 = 0;
}
if( DeviceList )
WmipFreeTraceDeviceList(DeviceList, (unsigned int)DeviceCount);
return v1;
}Referenced by:
EtwpDisableKernelTrace