EtwGetProviderIdFromHandle

NTSTATUS __stdcall EtwGetProviderIdFromHandle(UINT64 RegHandle, INT8 RequestorMode, _GUID *ProviderId){
  int v3; 
  VOID *v7; 
  PVOID Object; 

  v3 = 0;
  if( RequestorMode )
  {
    Object = 0i64;
    v3 = ObReferenceObjectByHandle((VOID *)RegHandle, 0x800ui64, EtwpRegistrationObjectType, 1, &Object, 0i64);
    if( v3 >= 0 )
    {
      v7 = Object;
      *ProviderId = *(_GUID *)(*((_QWORD *)Object + 4) + 40i64);
      ObfDereferenceObjectWithTag(v7, 0x746C6644ui64);
    }
    return v3;
  }
  if( RegHandle && EtwpReferenceGuidEntry(*(_ETW_GUID_ENTRY **)(RegHandle + 32)) )
  {
    *ProviderId = *(_GUID *)(*(_QWORD *)(RegHandle + 32) + 40i64);
    EtwpUnreferenceGuidEntry(*(_ETW_GUID_ENTRY **)(RegHandle + 32));
    return v3;
  }
  return -1073741816;
}

Referenced by: