EtwpComputeRegEntryEnableInfo
VOID __fastcall EtwpComputeRegEntryEnableInfo(_ETW_REG_ENTRY *RegEntry, _TRACE_ENABLE_INFO *EnableInfo){
_ETW_GUID_ENTRY *GuidEntry;
_ETW_GUID_ENTRY *GroupEntry;
int EnableMask;
int GroupEnableMask;
_ETW_GUID_ENTRY *HostEntry;
int HostEnableMask;
int HostGroupEnableMask;
_ETW_GUID_ENTRY *v10;
unsigned int v11;
int v12;
unsigned __int64 *p_MatchAnyKeyword;
unsigned int v14;
unsigned __int8 *p_Level;
unsigned __int8 Level;
unsigned __int8 v17;
unsigned int v18;
unsigned __int64 *v19;
unsigned __int8 v20;
unsigned int v21;
unsigned __int8 *v22;
unsigned __int8 v23;
GuidEntry = RegEntry->GuidEntry;
GroupEntry = RegEntry->GroupEntry;
EnableMask = RegEntry->EnableMask;
GroupEnableMask = RegEntry->GroupEnableMask;
HostEntry = GuidEntry->HostEntry;
HostEnableMask = RegEntry->HostEnableMask;
HostGroupEnableMask = RegEntry->HostGroupEnableMask;
if( GroupEntry )
v10 = GroupEntry->HostEntry;
else
v10 = 0i64;
*(_QWORD *)&EnableInfo->IsEnabled = 0i64;
v11 = 0;
*(_QWORD *)&EnableInfo->EnableProperty = 0i64;
v12 = EnableMask;
EnableInfo->MatchAnyKeyword = 0i64;
EnableInfo->MatchAllKeyword = -1i64;
p_MatchAnyKeyword = &GuidEntry->EnableInfo[0].MatchAnyKeyword;
do
{
if( _bittest(&v12, (unsigned __int8)v11) )
{
Level = EnableInfo->Level;
EnableInfo->IsEnabled = 1;
if( Level <= *((_BYTE *)p_MatchAnyKeyword - 12) )
Level = *((_BYTE *)p_MatchAnyKeyword - 12);
EnableInfo->Level = Level;
EnableInfo->MatchAnyKeyword |= *p_MatchAnyKeyword;
EnableInfo->MatchAllKeyword &= p_MatchAnyKeyword[1];
EnableInfo->EnableProperty |= *((_DWORD *)p_MatchAnyKeyword - 2);
}
++v11;
p_MatchAnyKeyword += 4;
}
while( v11 < 8 );
if( (_BYTE)GroupEnableMask )
{
v14 = 0;
p_Level = &GroupEntry->EnableInfo[0].Level;
do
{
if( _bittest(&GroupEnableMask, (unsigned __int8)v14) && *((_DWORD *)p_Level - 1) )
{
v17 = EnableInfo->Level;
EnableInfo->IsEnabled = 1;
if( v17 <= *p_Level )
v17 = *p_Level;
EnableInfo->Level = v17;
EnableInfo->MatchAnyKeyword |= *(_QWORD *)(p_Level + 12);
EnableInfo->MatchAllKeyword &= *(_QWORD *)(p_Level + 20);
EnableInfo->EnableProperty |= *((_DWORD *)p_Level + 1);
}
++v14;
p_Level += 32;
}
while( v14 < 8 );
}
if( RegEntry->GuidEntry->HostEntry )
{
if( (_BYTE)HostEnableMask )
{
v18 = 0;
v19 = &HostEntry->EnableInfo[0].MatchAnyKeyword;
do
{
if( _bittest(&HostEnableMask, (unsigned __int8)v18) )
{
v20 = EnableInfo->Level;
EnableInfo->IsEnabled = 1;
if( v20 <= *((_BYTE *)v19 - 12) )
v20 = *((_BYTE *)v19 - 12);
EnableInfo->Level = v20;
EnableInfo->MatchAnyKeyword |= *v19;
EnableInfo->MatchAllKeyword &= v19[1];
EnableInfo->EnableProperty |= *((_DWORD *)v19 - 2);
}
++v18;
v19 += 4;
}
while( v18 < 8 );
}
if( (_BYTE)HostGroupEnableMask )
{
v21 = 0;
v22 = &v10->EnableInfo[0].Level;
do
{
if( _bittest(&HostGroupEnableMask, (unsigned __int8)v21) && *((_DWORD *)v22 - 1) )
{
v23 = EnableInfo->Level;
EnableInfo->IsEnabled = 1;
if( v23 <= *v22 )
v23 = *v22;
EnableInfo->Level = v23;
EnableInfo->MatchAnyKeyword |= *(_QWORD *)(v22 + 12);
EnableInfo->MatchAllKeyword &= *(_QWORD *)(v22 + 20);
EnableInfo->EnableProperty |= *((_DWORD *)v22 + 1);
}
++v21;
v22 += 32;
}
while( v21 < 8 );
}
}
}Referenced by:
EtwpAddRegEntryToGroup
EtwpCalculateUpdateNotification
EtwpClearSessionAndUnreferenceEntry
EtwpRegisterProvider
EtwpRegisterUMGuid
SendCaptureStateNotificationsWorker