EtwpUpdateDisallowList
UINT64 __stdcall EtwpUpdateDisallowList(PVOID p, UINT64 Size){
UINT16 v2;
const VOID *v3;
UINT16 v4;
const VOID *v5;
_WMI_LOGGER_CONTEXT *NotificationContext;
INT64 v7;
unsigned int *v8;
unsigned int updated;
INT64 v11;
INT64 v12;
v4 = v2;
v5 = v3;
NotificationContext = EtwpAcquireLoggerContextByLoggerId((_ETW_SILODRIVERSTATE *)p, Size, 0);
v8 = (unsigned int *)NotificationContext;
if( NotificationContext )
{
updated = EtwpUpdateDisallowedGuids((INT64)NotificationContext, v4, v5, v7, v11, v12, NotificationContext);
EtwpReleaseLoggerContext(v8, 0);
}
else
{
return(unsigned int)-1073741811;
}
return updated;
}Referenced by:
EtwStartAutoLogger
NtTraceControl