EtwpIsRegEntryAllowed

UINT8 __stdcall EtwpIsRegEntryAllowed(
        _ETW_REG_ENTRY *RegEntry,
        _WMI_LOGGER_CONTEXT *LoggerContext,
        _ETW_SESSION_INFO *SessionInfo,
        _ETW_ENABLE_NOTIFICATION_PACKET *EnableNotificationPacket,
        _ETW_FILTER_STRING_TOKEN **ScopeFilters,
        UINT8 GuidType){
  unsigned int IsEnabled; 
  NTSTATUS v11; 
  char v13; 

  IsEnabled = EnableNotificationPacket->EnableInfo.IsEnabled;
  if( (RegEntry->Flags & 1) != 0 && (SessionInfo->PagedSession || SessionInfo->PrivateSession)
    || (IsEnabled == 2 || SessionInfo->PrivateSession)
    && !EtwpApplyTransientFilters(RegEntry, (INT64)EnableNotificationPacket, (INT64)ScopeFilters[10], ScopeFilters)
    || (RegEntry->Flags & 8) != 0
    && (v13 == 2
     || GuidType
     || !IsEnabled && EnableNotificationPacket->LegacyEnableContext.LoggerId != RegEntry->GuidEntry->LastEnable.LoggerId) )
  {
    return 0;
  }
  if( SessionInfo->PrivateSession == 1 )
  {
    v11 = EtwpCheckCurrentUserProcessAccess(RegEntry->Process);
  }
  else
  {
    if( v13 == 2 && !EtwpIsGuidAllowed(LoggerContext, &RegEntry->GuidEntry->Guid, &SessionInfo->SessionGuid) )
      return 0;
    v11 = EtwpCheckProviderLoggingAccess(RegEntry, &SessionInfo->SessionGuid, SessionInfo->SecureSession);
  }
  return !v11;
}

Referenced by: