EtwpUpdateDisallowList

UINT64 __stdcall EtwpUpdateDisallowList(PVOID p, UINT64 Size){
  UINT16 v2; 
  const VOID *v3; 
  UINT16 v4; 
  const VOID *v5; 
  _WMI_LOGGER_CONTEXT *NotificationContext; 
  INT64 v7; 
  unsigned int *v8; 
  unsigned int updated; 
  INT64 v11; 
  INT64 v12; 
  v4 = v2;
  v5 = v3;
  NotificationContext = EtwpAcquireLoggerContextByLoggerId((_ETW_SILODRIVERSTATE *)p, Size, 0);
  v8 = (unsigned int *)NotificationContext;
  if( NotificationContext )
  {
    updated = EtwpUpdateDisallowedGuids((INT64)NotificationContext, v4, v5, v7, v11, v12, NotificationContext);
    EtwpReleaseLoggerContext(v8, 0);
  }
  else
  {
    return(unsigned int)-1073741811;
  }
  return updated;
}

Referenced by:

EtwStartAutoLogger
NtTraceControl