EtwpUMGLEnabled

UINT8 __stdcall EtwpUMGLEnabled(_EPROCESS *Process, UINT64 UmglIndex){
  _PEB *Peb; 
  _EX_RUNDOWN_REF *p_RundownProtect; 
  UINT8 v5; 
  const signed __int32 *v6; 
  _EWOW64PROCESS *WoW64Process; 
  _KAPC_STATE ApcState; 

  memset(&ApcState, 0, sizeof(ApcState));
  Peb = Process->Peb;
  if( !Peb )
    return 0;
  p_RundownProtect = &Process->RundownProtect;
  if( !ExAcquireRundownProtection(&Process->RundownProtect) )
    return 0;
  KiStackAttachProcess(Process, 0i64, &ApcState);
  v5 = _bittest((const signed __int32 *)&Peb->888, 0);
  v6 = 0i64;
  WoW64Process = Process->WoW64Process;
  if( WoW64Process )
    v6 = (const signed __int32 *)WoW64Process->Peb;
  if( v6 && (v5 || _bittest(v6 + 144, 0)) )
    v5 = 1;
  KiUnstackDetachProcess(&ApcState, 0i64);
  ExReleaseRundownProtection(p_RundownProtect);
  return v5;
}

Referenced by: