EtwpRegisterUMGuid

NTSTATUS __fastcall EtwpRegisterUMGuid(_ETW_SILODRIVERSTATE *SiloState, _GUID *Guid, UINT64 a3, CHAR a4, INT64 a5){
  unsigned int Data1; 
  unsigned int v8; 
  bool v9; 
  __int64 v10; 
  _BOOL4 v12; 
  _ETW_GUID_ENTRY *GuidEntryByGuid; 
  void *SecurityDescriptor; 
  int v15; 
  _ETHREAD *v16; 
  int SchematizedFilterSize; 
  unsigned int v18; 
  UINT8 *v19; 
  _ETW_REG_ENTRY *v20; 
  UINT8 *v21; 
  _ETW_GUID_ENTRY *HostEntry; 
  unsigned __int8 v23; 
  UINT8 v24; 
  __int64 v25; 
  int v26; 
  __int64 v27; 
  __int64 v28; 
  _ETW_GUID_ENTRY *v29; 
  _ETHREAD *CurrentThread; 
  _KPROCESSOR_MODE AccessMode; 
  unsigned __int8 EnableMask; 
  int AccessStatus; 
  unsigned int GrantedAccess[2]; 
  _ETW_REG_ENTRY *RegEntry; 
  PVOID v37; 
  _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  unsigned __int8 HostEnableMask; 
  __int64 v40; 

  Data1 = Guid[1].Data1;
  GrantedAccess[1] = *(_DWORD *)&Guid[1].Data2;
  v8 = a3;
  v10 = *(_QWORD *)&Guid->Data1 - SecurityProviderGuid;
  v9 = *(_QWORD *)&Guid->Data1 == (_QWORD)SecurityProviderGuid;
  v37 = 0i64;
  RegEntry = 0i64;
  HostEnableMask = 0;
  if( v9 )
    v10 = *(_QWORD *)Guid->Data4 - *((_QWORD *)&SecurityProviderGuid + 1);
  if( !v10 )
    return -1073741790;
  v12 = Data1 - 2 > 1;
  GuidEntryByGuid = EtwpFindGuidEntryByGuid(SiloState, Guid, (_ETW_GUID_TYPE)v12);
  if( !GuidEntryByGuid )
  {
    GuidEntryByGuid = EtwpAddGuidEntry(SiloState, Guid, (_ETW_GUID_TYPE)v12);
    if( !GuidEntryByGuid )
      return -1073741801;
  }
  SecurityDescriptor = GuidEntryByGuid->SecurityDescriptor;
  AccessStatus = 0;
  GrantedAccess[0] = 0;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  SeCaptureSubjectContext((INT64)&SubjectContext);
  LOBYTE(AccessMode) = 1;
  SeAccessCheck(
    SecurityDescriptor,
    &SubjectContext,
    0,
    2048,
    0,
    0i64,
    (PGENERIC_MAPPING)&EtwpGenericMapping,
    AccessMode,
    GrantedAccess,
    &AccessStatus);
  SeReleaseSubjectContext(&SubjectContext);
  v15 = AccessStatus;
  if( AccessStatus >= 0 )
  {
    if( GuidEntryByGuid->HostEntry )
    {
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --CurrentThread->Tcb.KernelApcDisable;
      ExAcquirePushLockExclusiveEx(&GuidEntryByGuid->HostEntry->Lock, 0i64);
      GuidEntryByGuid->HostEntry->LockOwner = (_ETHREAD *)KeGetCurrentThread();
    }
    v16 = (_ETHREAD *)KeGetCurrentThread();
    --v16->Tcb.KernelApcDisable;
    ExAcquirePushLockExclusiveEx(&GuidEntryByGuid->Lock, 0i64);
    GuidEntryByGuid->LockOwner = (_ETHREAD *)KeGetCurrentThread();
    *(_DWORD *)a5 = 160;
    SchematizedFilterSize = EtwpGetSchematizedFilterSize(GuidEntryByGuid, 0xFFu);
    v18 = 160;
    if( SchematizedFilterSize )
    {
      v18 = SchematizedFilterSize + 176;
      *(_DWORD *)a5 = SchematizedFilterSize + 176;
    }
    if( v18 > v8 )
    {
      v15 = -1073741789;
    }
    else
    {
      v15 = EtwpAddUmRegEntry(GuidEntryByGuid, (__int64)&RegEntry, &v37);
      if( v15 >= 0 )
      {
        if( a4 )
          _InterlockedOr16((volatile signed __int16 *)&RegEntry->98, 0x100u);
        v20 = RegEntry;
        *(_QWORD *)Guid[1].Data4 = v37;
        if( GuidEntryByGuid->ProviderEnableInfo.IsEnabled )
        {
          LOBYTE(v19) = 1;
          EtwpUpdateEnableMask(GuidEntryByGuid, (v20->Flags & 8) != 0, 0, v19);
        }
        EnableMask = v20->EnableMask;
        EtwpApplyScopeFilters(v20, (v20->Flags & 8) != 0, 0, 0i64);
        HostEntry = GuidEntryByGuid->HostEntry;
        if( HostEntry )
        {
          if( HostEntry->ProviderEnableInfo.IsEnabled )
          {
            LOBYTE(v21) = 1;
            EtwpUpdateEnableMask(HostEntry, (v20->Flags & 8) != 0, 1, v21);
          }
          LOBYTE(v21) = 1;
          HostEnableMask = v20->HostEnableMask;
          EtwpApplyScopeFilters(v20, (v20->Flags & 8) != 0, 0, v21);
        }
        if( (v20->Flags & 8) != 0 )
        {
          v20->EnableMask = EnableMask;
          v23 = HostEnableMask;
          v20->HostEnableMask = HostEnableMask;
        }
        else
        {
          v20->EnableMask &= EnableMask;
          v20->HostEnableMask &= HostEnableMask;
          v23 = v20->HostEnableMask;
        }
        v24 = v20->EnableMask;
        if( v24 || v23 )
        {
          EtwpComputeRegEntryEnableInfo(v20, (_TRACE_ENABLE_INFO *)&Guid[7]);
          *(_DWORD *)Guid[9].Data4 = GuidEntryByGuid->LastEnable._bf_b & 1;
          LOWORD(v40) = GuidEntryByGuid->LastEnable.LoggerId;
          WORD1(v40) = GuidEntryByGuid->LastEnable.Level;
          HIDWORD(v40) = GuidEntryByGuid->LastEnable.EnableFlags.anonymous_0.LowPart;
          v25 = v40;
        }
        else
        {
          v25 = 0i64;
          Guid[7] = 0i64;
          Guid[8] = 0i64;
          *(_DWORD *)Guid[9].Data4 = 0;
        }
        *(_QWORD *)&Guid[9].Data1 = v25;
        *(_DWORD *)a5 = 160;
        v26 = EtwpGetSchematizedFilterSize(GuidEntryByGuid, v24);
        if( v26 )
        {
          *(_DWORD *)a5 = v26 + 176;
          *(_DWORD *)Guid[10].Data4 = v26;
          *(_DWORD *)&Guid[10].Data4[4] = 0x80000000;
          *(_QWORD *)&Guid[10].Data1 = 136i64;
          EtwpCopySchematizedFilters(&Guid[11], (__int64)GuidEntryByGuid, v24);
          v26 = 1;
        }
        *(_DWORD *)&Guid[9].Data4[4] = v26;
        *(_DWORD *)&Guid[2].Data4[4] = *(_DWORD *)a5;
        EtwpTrackProviderRegistration(v20);
        if( EtwEventEnabled(*(&ExBootDevicesRemovedEvent + 241), &ETW_EVENT_PROVIDER_REGISTER) )
          EtwpEventWriteTemplateSessAndProv(v27, &ETW_EVENT_PROVIDER_REGISTER, v28, 1, 0i64, (unsigned __int64)Guid);
      }
    }
    GuidEntryByGuid->LockOwner = 0i64;
    ExReleasePushLockEx((_DWORD)GuidEntryByGuid + 408, 0);
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
    v29 = GuidEntryByGuid->HostEntry;
    if( v29 )
    {
      v29->LockOwner = 0i64;
      ExReleasePushLockEx((ULONG_PTR)&GuidEntryByGuid->HostEntry->Lock, 0);
      KeLeaveCriticalRegionThread(KeGetCurrentThread());
    }
    if( RegEntry )
      HalPutDmaAdapter((PADAPTER_OBJECT)RegEntry);
  }
  EtwpUnreferenceGuidEntry(GuidEntryByGuid);
  return v15;
}

Referenced by: