EtwpUpdateGuidEnableInfo

NTSTATUS __stdcall EtwpUpdateGuidEnableInfo(
        _ETW_GUID_ENTRY *GuidEntry,
        _ETW_ENABLE_NOTIFICATION_PACKET *EnableNotificationPacket,
        UINT64 OriginalEnableFlags,
        _ETW_FILTER_INFO *FilterInfo,
        UINT8 *EnableMask){
  unsigned int IsEnabled; 
  unsigned int v9; 
  __int64 v10; 
  unsigned int v11; 
  unsigned __int8 v12; 
  unsigned __int8 *v13; 
  __int64 v14; 
  __int64 v15; 
  __int32 v16; 
  unsigned __int8 v18; 
  unsigned __int8 v19; 
  unsigned __int8 *p_Level; 
  __int64 v21; 
  __int64 v22; 
  __int32 v23; 
  unsigned __int8 v24; 
  _TRACE_ENABLE_INFO v25; 
  _TRACE_ENABLE_INFO v26; 

  IsEnabled = EnableNotificationPacket->EnableInfo.IsEnabled;
  if( IsEnabled == 1 )
  {
    GuidEntry->LastEnable._bf_b ^= (GuidEntry->LastEnable._bf_b ^ LOBYTE(EnableNotificationPacket->LegacyProviderEnabled)) & 1;
    GuidEntry->LastEnable._bf_b = GuidEntry->LastEnable._bf_b & 1 | (2
                                                                   * EnableNotificationPacket->LegacyEnableContext.InternalFlag);
    GuidEntry->LastEnable.LoggerId = EnableNotificationPacket->LegacyEnableContext.LoggerId;
    GuidEntry->LastEnable.Level = EnableNotificationPacket->LegacyEnableContext.Level;
    GuidEntry->LastEnable.EnableFlags.QuadPart = OriginalEnableFlags;
  }
  else if( !IsEnabled && GuidEntry->LastEnable.LoggerId == EnableNotificationPacket->LegacyEnableContext.LoggerId )
  {
    GuidEntry->LastEnable._bf_b &= ~1u;
  }
  v9 = 0;
  v10 = 8i64;
  do
  {
    if( GuidEntry->EnableInfo[v9].IsEnabled
      && GuidEntry->EnableInfo[v9].LoggerId == EnableNotificationPacket->EnableInfo.LoggerId )
    {
      *(_QWORD *)&v26.IsEnabled = 0i64;
      v19 = 0;
      p_Level = &GuidEntry->EnableInfo[0].Level;
      v21 = 0i64;
      v22 = -1i64;
      v26.Reserved2 = 0;
      v23 = 0;
      v26.MatchAllKeyword = -1i64;
      GuidEntry->EnableInfo[v9] = EnableNotificationPacket->EnableInfo;
      do
      {
        if( *((_DWORD *)p_Level - 1) )
        {
          v24 = v19;
          v26.IsEnabled = 1;
          if( v19 <= *p_Level )
            v24 = *p_Level;
          v22 &= *(_QWORD *)(p_Level + 20);
          v21 |= *(_QWORD *)(p_Level + 12);
          v19 = v24;
          v23 |= *((_DWORD *)p_Level + 1);
          v26.MatchAllKeyword = v22;
        }
        p_Level += 32;
        --v10;
      }
      while( v10 );
      v26.Level = v19;
      v26.EnableProperty = v23;
      *EnableMask = 1 << v9;
      v26.MatchAnyKeyword = v21;
      GuidEntry->ProviderEnableInfo = v26;
      EtwpUpdateFilterData(
        GuidEntry,
        v9,
        EnableNotificationPacket,
        EnableNotificationPacket->EnableInfo.IsEnabled == 0,
        FilterInfo);
      if( !EnableNotificationPacket->EnableInfo.IsEnabled )
        EtwpUnreferenceGuidEntry(GuidEntry);
      return 0;
    }
    ++v9;
  }
  while( v9 < 8 );
  if( EnableNotificationPacket->EnableInfo.IsEnabled )
  {
    v11 = 0;
    while( GuidEntry->EnableInfo[v11].IsEnabled )
    {
      if( ++v11 >= 8 )
        return -1073741670;
    }
    *(_QWORD *)&v25.IsEnabled = 0i64;
    v12 = 0;
    v13 = &GuidEntry->EnableInfo[0].Level;
    v14 = 0i64;
    v15 = -1i64;
    v25.Reserved2 = 0;
    v16 = 0;
    v25.MatchAllKeyword = -1i64;
    GuidEntry->EnableInfo[v11] = EnableNotificationPacket->EnableInfo;
    do
    {
      if( *((_DWORD *)v13 - 1) )
      {
        v18 = v12;
        v25.IsEnabled = 1;
        if( v12 <= *v13 )
          v18 = *v13;
        v15 &= *(_QWORD *)(v13 + 20);
        v14 |= *(_QWORD *)(v13 + 12);
        v12 = v18;
        v16 |= *((_DWORD *)v13 + 1);
        v25.MatchAllKeyword = v15;
      }
      v13 += 32;
      --v10;
    }
    while( v10 );
    v25.Level = v12;
    v25.EnableProperty = v16;
    *EnableMask = 1 << v11;
    v25.MatchAnyKeyword = v14;
    GuidEntry->ProviderEnableInfo = v25;
    EtwpUpdateFilterData(
      GuidEntry,
      v11,
      EnableNotificationPacket,
      EnableNotificationPacket->EnableInfo.IsEnabled == 0,
      FilterInfo);
    EtwpReferenceGuidEntry(GuidEntry);
    return 0;
  }
  return -1073741275;
}

Referenced by: