EtwpUMGLEnabled

UINT8 __fastcall EtwpUMGLEnabled(_EPROCESS *Process, UINT64 UmglIndex){
  __int64 v3; 
  struct _EX_RUNDOWN_REF *v4; 
  UINT8 v5; 
  __int64 v6; 
  __int64 *v7; 
  _KAPC_STATE ApcState; 
  memset(&ApcState, 0, sizeof(ApcState));
  v3 = *((_QWORD *)Process + 170);
  if( !v3 )
    return 0;
  v4 = (struct _EX_RUNDOWN_REF *)((char *)Process + 1112);
  if( !ExAcquireRundownProtection((PEX_RUNDOWN_REF)Process + 139) )
    return 0;
  KiStackAttachProcess((_KPROCESS *)Process, 0i64, &ApcState);
  v5 = _bittest((const signed __int32 *)(v3 + 888), 0);
  v6 = 0i64;
  v7 = (__int64 *)*((_QWORD *)Process + 176);
  if( v7 )
    v6 = *v7;
  if( v6 && (v5 || _bittest((const signed __int32 *)(v6 + 576), 0)) )
    v5 = 1;
  KiUnstackDetachProcess(&ApcState, 0i64);
  ExReleaseRundownProtection(v4);
  return v5;
}

Referenced by: