EtwpUpdateLoggerSecurityDescriptor

NTSTATUS __stdcall EtwpUpdateLoggerSecurityDescriptor(_WMI_LOGGER_CONTEXT *LoggerContext, VOID *SecurityDescriptor){
  int v3; 
  __int64 v4; 
  _ETHREAD *CurrentThread; 
  __int64 v6; 
  int v8[10]; 
  unsigned __int64 v9; 

  v9 = 0i64;
  v3 = ObLogSecurityDescriptor(SecurityDescriptor, (VOID **)&v9, 0x10ui64);
  if( v3 >= 0 )
  {
    v4 = _InterlockedExchange64(
           (volatile __int64 *)&LoggerContext->SecurityDescriptor,
           (v9 | 0xF) & -(__int64)(v9 != 0));
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    _InterlockedOr(v8, 0);
    if( (*(&ExBootDevicesRemovedEvent + 2104) & 1) != 0 )
      ExfAcquireReleasePushLockExclusive((_EX_PUSH_LOCK *)&ExBootDevicesRemovedEvent + 263);
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
    ObDereferenceSecurityDescriptor((VOID *)(v4 & 0xFFFFFFFFFFFFFFF0ui64), (unsigned int)(v4 & 0xF) + 1);
    if( EtwEventEnabled(*(&ExBootDevicesRemovedEvent + 241), &ETW_EVENT_CHANGE_SESSION_SD) )
      EtwpEventWriteTemplateSession(v6, &ETW_EVENT_CHANGE_SESSION_SD, (__int64)LoggerContext);
  }
  return v3;
}

Referenced by: