EtwpRegisterProvider

NTSTATUS __stdcall EtwpRegisterProvider(
        _ETW_SILODRIVERSTATE *SiloState,
        _GUID *ProviderId,
        UINT64 Type,
        VOID *Callback,
        VOID *CallbackContext,
        VOID *Caller,
        UINT64 *RegHandle){
  bool v10; 
  __int64 v11; 
  _ETW_GUID_ENTRY *GuidEntryByGuid; 
  _ETHREAD *v13; 
  ULONG_PTR v14; 
  NTSTATUS v15; 
  _ETW_REG_ENTRY *v16; 
  _ETW_GUID_ENTRY *HostEntry; 
  __int64 v18; 
  __int64 v19; 
  __int64 v20; 
  _ETW_GUID_ENTRY *v21; 
  VOID **PoolWithTag; 
  unsigned int SchematizedFilterSize; 
  __int64 v25; 
  unsigned int v26; 
  _ETHREAD *CurrentThread; 
  unsigned __int8 EnableMask; 
  __int64 p_EnableMask; 
  _ETW_REG_ENTRY *RegEntry; 
  VOID *v31; 
  _TRACE_ENABLE_INFO EnableInfo; 
  unsigned __int16 LoggerId; 
  unsigned __int8 Level; 
  char v35; 
  ULONG LowPart; 
  LONG HighPart; 
  int v38; 
  __int128 v39; 

  RegEntry = 0i64;
  v31 = CallbackContext;
  *RegHandle = 0i64;
  v11 = *(_QWORD *)&ProviderId->Data1 - SecurityProviderGuid;
  v10 = *(_QWORD *)&ProviderId->Data1 == (_QWORD)SecurityProviderGuid;
  memset(&EnableInfo, 0, sizeof(EnableInfo));
  if( v10 )
    v11 = *(_QWORD *)ProviderId->Data4 - *((_QWORD *)&SecurityProviderGuid + 1);
  if( !v11 )
    return -1073741790;
  if( !Callback && CallbackContext || (_DWORD)Type != 3 && ((_DWORD)Type != 2 || !Callback) )
    return -1073741811;
  GuidEntryByGuid = EtwpFindGuidEntryByGuid(SiloState, ProviderId, EtwTraceGuidType);
  if( !GuidEntryByGuid )
  {
    GuidEntryByGuid = EtwpAddGuidEntry(SiloState, ProviderId, EtwTraceGuidType);
    if( !GuidEntryByGuid )
      return -1073741801;
  }
  if( GuidEntryByGuid->HostEntry )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    ExAcquirePushLockExclusiveEx(&GuidEntryByGuid->HostEntry->Lock, 0i64);
    GuidEntryByGuid->HostEntry->LockOwner = (_ETHREAD *)KeGetCurrentThread();
  }
  v13 = (_ETHREAD *)KeGetCurrentThread();
  --v13->Tcb.KernelApcDisable;
  v14 = (_DWORD)GuidEntryByGuid + 408;
  ExAcquirePushLockExclusiveEx(&GuidEntryByGuid->Lock, 0i64);
  GuidEntryByGuid->LockOwner = (_ETHREAD *)KeGetCurrentThread();
  v15 = EtwpAddKmRegEntry(GuidEntryByGuid, (__int64)&RegEntry);
  if( v15 >= 0 )
  {
    v16 = RegEntry;
    RegEntry->ReplyQueue = (_ETW_REPLY_QUEUE *)Caller;
    *RegHandle = (UINT64)v16;
    if( GuidEntryByGuid->ProviderEnableInfo.IsEnabled )
    {
      p_EnableMask = (__int64)&v16->EnableMask;
      EtwpUpdateEnableMask(GuidEntryByGuid, (v16->Flags & 8) != 0, 0, 0i64);
    }
    HostEntry = GuidEntryByGuid->HostEntry;
    if( HostEntry && HostEntry->ProviderEnableInfo.IsEnabled )
    {
      p_EnableMask = (__int64)&v16->HostEnableMask;
      EtwpUpdateEnableMask(HostEntry, (v16->Flags & 8) != 0, 1, 0i64);
    }
    EtwpComputeRegEntryEnableInfo(v16, &EnableInfo);
    EtwpTrackProviderRegistration(v16);
    if( Callback )
    {
      if( (v16->Flags & 8) != 0 )
      {
        if( (GuidEntryByGuid->LastEnable._bf_b & 1) != 0 )
        {
          LoggerId = GuidEntryByGuid->LastEnable.LoggerId;
          LOBYTE(v18) = 1;
          Level = GuidEntryByGuid->LastEnable.Level;
          LowPart = GuidEntryByGuid->LastEnable.EnableFlags.anonymous_0.LowPart;
          HighPart = GuidEntryByGuid->LastEnable.EnableFlags.anonymous_0.HighPart;
          v35 = 0;
          v38 = 0;
          ((void(__fastcall *)(_GUID *, __int64, unsigned __int16 *, VOID *, __int64))Callback)(
            &GuidEntryByGuid->Guid,
            v18,
            &LoggerId,
            v31,
            p_EnableMask);
        }
      }
      else if( EnableInfo.IsEnabled )
      {
        RegEntry = 0i64;
        v39 = 0i64;
        PoolWithTag = 0i64;
        SchematizedFilterSize = EtwpGetSchematizedFilterSize(GuidEntryByGuid, v16->EnableMask);
        v26 = SchematizedFilterSize;
        if( SchematizedFilterSize )
        {
          PoolWithTag = ExAllocatePoolWithTag(1ui64, SchematizedFilterSize, 1182233669i64);
          if( PoolWithTag )
          {
            *(_QWORD *)&v39 = PoolWithTag;
            *((_QWORD *)&v39 + 1) = v26 | 0x8000000000000000ui64;
            EnableMask = v16->EnableMask;
            RegEntry = (_ETW_REG_ENTRY *)&v39;
            EtwpCopySchematizedFilters(PoolWithTag, (__int64)GuidEntryByGuid, EnableMask);
          }
        }
        LOBYTE(v25) = EnableInfo.Level;
        ((void(__fastcall *)(GUID *, __int64, __int64, unsigned __int64, unsigned __int64, _ETW_REG_ENTRY *, VOID *))Callback)(
          &NullGuid,
          1i64,
          v25,
          EnableInfo.MatchAnyKeyword,
          EnableInfo.MatchAllKeyword,
          RegEntry,
          v31);
        if( PoolWithTag )
          ExFreePoolWithTag(PoolWithTag, 0);
        v14 = (_DWORD)GuidEntryByGuid + 408;
      }
    }
    if( EtwEventEnabled(*(&ExBootDevicesRemovedEvent + 241), &ETW_EVENT_PROVIDER_REGISTER) )
      EtwpEventWriteTemplateSessAndProv(v19, &ETW_EVENT_PROVIDER_REGISTER, v20, 1, 0i64, (unsigned __int64)ProviderId);
  }
  GuidEntryByGuid->LockOwner = 0i64;
  ExReleasePushLockEx(v14, 0);
  KeLeaveCriticalRegion();
  v21 = GuidEntryByGuid->HostEntry;
  if( v21 )
  {
    v21->LockOwner = 0i64;
    ExReleasePushLockEx((ULONG_PTR)&GuidEntryByGuid->HostEntry->Lock, 0);
    KeLeaveCriticalRegion();
  }
  EtwpUnreferenceGuidEntry(GuidEntryByGuid);
  return v15;
}

Referenced by: