EtwpEnableDisableUMGL

NTSTATUS __stdcall EtwpEnableDisableUMGL(UINT8 Enable, UINT16 LoggerId, UINT8 UmglFlags, UINT64 UMGLProviderIndex){
  NTSTATUS v4; 
  char v6; 
  char v7; 
  __int64 v8; 
  char v9; 
  __int16 v11; 
  unsigned int v12; 

  v4 = 0;
  v6 = UMGLProviderIndex;
  v7 = LoggerId;
  if( Enable == EtwpHostSiloState )
    v8 = 0xFFFFF78000000380ui64;
  else
    v8 = *(_QWORD *)(*(_QWORD *)(Enable + 8i64) + 1128i64) + 550i64;
  if( (unsigned int)UmglFlags >= *(_DWORD *)(Enable + 16i64) || !UmglFlags )
    return -1073741816;
  KeWaitForSingleObject((UINT64)&ExBootDevicesRemovedEvent + 1376, 0, 0, 0, 0i64);
  if( v7 )
  {
    LOBYTE(v11) = UmglFlags;
    HIBYTE(v11) = v6;
    *(_WORD *)(v8 + 2i64 * v12) = v11;
  }
  else
  {
    v9 = *(_BYTE *)(v8 + 2i64 * v12);
    if( v9 == UmglFlags )
      *(_WORD *)(v8 + 2i64 * v12) = 0;
    else
      v4 = v9 != 0 ? -1073741734 : -1073741054;
  }
  KeReleaseMutex((_KMUTANT *)((char *)&ExBootDevicesRemovedEvent + 1376), 0);
  return v4;
}

Referenced by: