EtwpGetDisallowList

NTSTATUS __stdcall EtwpGetDisallowList(
        _ETW_SILODRIVERSTATE *SiloState,
        UINT64 *pTraceHandle,
        VOID *Buffer,
        UINT64 *OutBufferLen){
  size_t v5; 
  NTSTATUS v6; 
  _WMI_LOGGER_CONTEXT *v8; 
  size_t v9; 

  v5 = *(_DWORD *)OutBufferLen;
  v6 = 0;
  v8 = EtwpAcquireLoggerContextByLoggerId(SiloState, *(unsigned __int16 *)pTraceHandle, 0);
  if( !v8 )
    return -1073741811;
  memset(Buffer, 0i64, *(_DWORD *)OutBufferLen);
  ExAcquirePushLockSharedEx(&v8->LoggerLock, 0i64);
  v9 = 16 * v8->DisallowedGuids.Count;
  if( v9 > v5 )
    v6 = -1073741789;
  else
    memmove(Buffer, v8->DisallowedGuids.Guids, v9);
  *(_DWORD *)OutBufferLen = v9;
  if( _InterlockedCompareExchange64(&v8->LoggerLock._bf_0, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared(&v8->LoggerLock);
  KeAbPostRelease(&v8->LoggerLock);
  EtwpReleaseLoggerContext(v8, 0);
  return v6;
}

Referenced by: