EtwpDisallowedGuidAddition

VOID __stdcall EtwpDisallowedGuidAddition(_GUID *Guid, VOID *NotificationContext){
  _WMI_LOGGER_CONTEXT *v2; 
  _ETW_GUID_ENTRY *GuidEntryByGuid; 
  _ETW_GUID_ENTRY *v5; 
  _ETHREAD *CurrentThread; 
  ULONG_PTR v7; 
  NTSTATUS v8; 
  _ETWP_NOTIFICATION_HEADER *v9; 
  _GUID *v10; 
  _EX_PUSH_LOCK *p_Lock; 
  _ETW_GUID_ENTRY *Flink; 
  _ETW_GUID_ENTRY *v13; 
  unsigned __int8 v14; 
  _ETW_REG_ENTRY *v15; 
  _ETW_REG_ENTRY *v16; 
  _ETW_REG_ENTRY *v17; 
  _ETW_GUID_ENTRY *GroupEntry; 
  UINT8 v19; 
  unsigned __int8 v20; 
  UINT8 v21; 
  _ETWP_NOTIFICATION_HEADER *v22; 
  UINT8 updated; 
  _ETHREAD *v24; 
  UINT64 ControlCode; 
  _ETWP_NOTIFICATION_HEADER **v26; 
  _ETW_REG_ENTRY *RegEntry; 
  UINT8 v29; 
  _ETWP_NOTIFICATION_HEADER *NotificationPacket; 

  NotificationPacket = 0i64;
  v2 = (_WMI_LOGGER_CONTEXT *)NotificationContext;
  GuidEntryByGuid = EtwpFindGuidEntryByGuid(
                      *((_ETW_SILODRIVERSTATE **)NotificationContext + 135),
                      Guid,
                      EtwTraceGuidType);
  v5 = GuidEntryByGuid;
  if( GuidEntryByGuid )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    v7 = (_DWORD)GuidEntryByGuid + 408;
    ExAcquirePushLockExclusiveEx(&GuidEntryByGuid->Lock, 0i64);
    v5->LockOwner = (_ETHREAD *)KeGetCurrentThread();
    v8 = EtwpBuildNotificationPacket(v5, 0i64, 0, &NotificationPacket);
    v9 = NotificationPacket;
    if( !v8 )
    {
      NotificationPacket->NotificationType = EtwNotificationTypeEnable;
      v9->DestinationGuid = *Guid;
      v9->SourcePID = (unsigned int)PsGetCurrentThreadProcessId();
      if( EtwpIsGuidAllowed(v2, Guid, v10) != 1 )
      {
        p_Lock = 0i64;
        if( !v5->HostEntry )
        {
          Flink = (_ETW_GUID_ENTRY *)v5->SiloGuidList.Flink;
          if( Flink != (_ETW_GUID_ENTRY *)&v5->SiloGuidList )
            p_Lock = &Flink[-1].Lock;
        }
        v13 = v5;
        v14 = 0;
        while( 1 )
        {
          v15 = (_ETW_REG_ENTRY *)v13->RegListHead.Flink;
LABEL_27:
          while( v15 != (_ETW_REG_ENTRY *)&v13->RegListHead )
          {
            v16 = v15;
            RegEntry = v15;
            v17 = v15;
            v15 = (_ETW_REG_ENTRY *)v15->RegList.Flink;
            GroupEntry = v16->GroupEntry;
            if( GroupEntry )
            {
              if( v14 )
                GroupEntry = GroupEntry->HostEntry;
              v19 = *(&v16->GroupEnableMask + 2 * v14);
              if( v19 )
              {
                v20 = 0;
                while( !GroupEntry->EnableInfo[v20].IsEnabled || GroupEntry->EnableInfo[v20].LoggerId != v2->LoggerId )
                {
                  if( ++v20 >= 8u )
                    goto LABEL_27;
                }
                v21 = 1 << v20;
                if( 1 << v20 && (v19 & v21) != 0 )
                {
                  v22 = v9;
                  *(&v17->GroupEnableMask + 2 * v14) = v19 & ~v21;
                  LODWORD(v26) = 0;
                  LOBYTE(ControlCode) = v14;
                  updated = EtwpCalculateUpdateNotification(v17, v21, v19, v19, 2u, ControlCode, v26);
                  v9 = NotificationPacket;
                  v29 = updated;
                  if( v22 != NotificationPacket )
                  {
                    if( NotificationPacket )
                    {
                      EtwpUnreferenceDataBlock(v22);
                      updated = v29;
                    }
                    else
                    {
                      v9 = v22;
                      NotificationPacket = v22;
                    }
                  }
                  if( updated )
                    EtwpSendDataBlock(RegEntry, v9);
                  v2 = (_WMI_LOGGER_CONTEXT *)NotificationContext;
                }
              }
            }
          }
          if( v13 != v5 )
          {
            v13->LockOwner = 0i64;
            ExReleasePushLockEx((_DWORD)v13 + 408, 0);
            KeLeaveCriticalRegionThread(KeGetCurrentThread());
            v9 = NotificationPacket;
          }
          if( !p_Lock )
            break;
          v24 = (_ETHREAD *)KeGetCurrentThread();
          v14 = 1;
          v13 = (_ETW_GUID_ENTRY *)p_Lock;
          --v24->Tcb.KernelApcDisable;
          ExAcquirePushLockExclusiveEx(p_Lock + 51, 0i64);
          p_Lock[52]._bf_0 = (__int64)KeGetCurrentThread();
          p_Lock = (_EX_PUSH_LOCK *)(p_Lock[2]._bf_0 - 16);
          if( p_Lock == (_EX_PUSH_LOCK *)v5 )
            p_Lock = 0i64;
          v9 = NotificationPacket;
        }
        v7 = (_DWORD)v5 + 408;
      }
    }
    if( v9 )
      EtwpUnreferenceDataBlock(v9);
    v5->LockOwner = 0i64;
    ExReleasePushLockEx(v7, 0);
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
    EtwpUnreferenceGuidEntry(v5);
  }
}

Referenced by: