EtwpUpdateFileInfoDriverState

__int64 __fastcall EtwpUpdateFileInfoDriverState(_DWORD *a1, _DWORD *a2, int a3, UINT64 *a4, UINT64 TraceClass){
  int v5; 
  NTSTATUS updated; 
  UINT64 *v8; 
  UINT64 v9; 
  UINT8 *v10; 
  NTSTATUS Driver; 
  _UNICODE_STRING DestinationString; 

  v5 = 0;
  DestinationString = 0i64;
  if( !a3 )
  {
    if( !a1 || (*a1 & 0x6000200) == 0 )
    {
      if( *(&stru_140CF2E80 + 1959) )
        WmiTraceRundownNotify(*a4, (unsigned int)TraceClass);
      EtwpUpdateFileInfoDriverRegistration(0i64);
      if( *(&stru_140CF2E80 + 1959) )
      {
        RtlInitUnicodeString(&DestinationString, L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\FileInfo");
        ZwUnloadDriver(&DestinationString);
        *(&stru_140CF2E80 + 1959) = 0;
      }
    }
LABEL_8:
    updated = 0;
    v5 = 0;
    goto LABEL_9;
  }
  if( !a2 || (*a2 & 0x6000200) == 0 )
    goto LABEL_8;
  if( !WmiQueryTraceProviderCount((UINT64)a1) )
  {
    RtlInitUnicodeString(&DestinationString, L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\FileInfo");
    Driver = ZwLoadDriver((UINT64 *)&DestinationString.Length, v8, v9, v10, *(UINT64 *)&DestinationString.Length);
    if( (int)(Driver + 0x80000000) >= 0 && Driver != -1073741554 )
      return(unsigned int)-1073741204;
    *(&stru_140CF2E80 + 1959) = 1;
    v5 = 1;
  }
  updated = EtwpUpdateFileInfoDriverRegistration(1ui64);
  if( updated >= 0 )
    goto LABEL_8;
LABEL_9:
  if( v5 )
  {
    RtlInitUnicodeString(&DestinationString, L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\FileInfo");
    ZwUnloadDriver(&DestinationString);
    *(&stru_140CF2E80 + 1959) = 0;
  }
  return(unsigned int)updated;
}

Referenced by: