EtwpUpdateFileInfoDriverState

INT64 __fastcall EtwpUpdateFileInfoDriverState(
        _PERFINFO_GROUPMASK *DesiredFlags,
        _PERFINFO_GROUPMASK *FlagsToChange,
        UINT64 StartingTrace,
        UINT64 LoggerId){
  int v4; 
  int updated; 
  WCHAR v7; 
  NTSTATUS v8; 
  struct _UNICODE_STRING DestinationString; 
  unsigned int TraceClass; 
  v4 = 0;
  DestinationString = 0i64;
  if( !(_DWORD)StartingTrace )
  {
    if( !DesiredFlags || (DesiredFlags->Masks[0] & 0x6000200) == 0 )
    {
      if( dword_140CF4D1C )
        WmiTraceRundownNotify(*(_QWORD *)LoggerId, TraceClass);
      EtwpUpdateFileInfoDriverRegistration(0i64);
      if( dword_140CF4D1C )
      {
        RtlInitUnicodeString(
          &DestinationString,
          L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\FileInfo",
          StartingTrace);
        ZwUnloadDriver(&DestinationString);
        dword_140CF4D1C = 0;
      }
    }
LABEL_8:
    updated = 0;
    v4 = 0;
    goto LABEL_9;
  }
  if( !FlagsToChange || (FlagsToChange->Masks[0] & 0x6000200) == 0 )
    goto LABEL_8;
  if( !(unsigned int)WmiQueryTraceProviderCount((UINT64)DesiredFlags) )
  {
    RtlInitUnicodeString(&DestinationString, L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\FileInfo", v7);
    v8 = ZwLoadDriver(&DestinationString);
    if( (int)(v8 + 0x80000000) >= 0 && v8 != -1073741554 )
      return(unsigned int)-1073741204;
    dword_140CF4D1C = 1;
    v4 = 1;
  }
  updated = EtwpUpdateFileInfoDriverRegistration(1ui64);
  if( updated >= 0 )
    goto LABEL_8;
LABEL_9:
  if( v4 )
  {
    RtlInitUnicodeString(
      &DestinationString,
      L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\FileInfo",
      StartingTrace);
    ZwUnloadDriver(&DestinationString);
    dword_140CF4D1C = 0;
  }
  return(unsigned int)updated;
}

Referenced by: