EtwpEnableDisableSpecialGuids

NTSTATUS __fastcall EtwpEnableDisableSpecialGuids(
        _ETW_SILODRIVERSTATE *SiloState,
        INT64 *a2,
        UINT16 a3,
        INT64 a4,
        UINT64 UMGLProviderIndex,
        INT64 a6,
        INT64 a7,
        INT64 a8){
  UINT8 v8; 
  unsigned int v9; 
  NTSTATUS v12; 
  UINT64 LoggerId; 
  UINT8 v14; 
  char v15; 
  unsigned int v16; 
  __int64(**v17)[2]; 
  INT64 v18; 
  INT64 v19; 
  unsigned __int64 v20; 
  INT64 v22; 
  NTSTATUS v23; 
  INT64 v25; 

  v8 = 1;
  v9 = a3;
  v12 = -1073741275;
  LoggerId = 2i64;
  *(_BYTE *)a8 = 1;
  if( (_DWORD)a4 != 2 )
  {
    v14 = 0;
    if( (_DWORD)a4 == 1 )
    {
      v15 = 1;
    }
    else
    {
      if( (_DWORD)a4 )
        goto LABEL_12;
      v15 = 0;
    }
    v16 = 0;
    v17 = &EtwpUmglProviders;
    do
    {
      v18 = *a2;
      v19 = (**v17)[0] - *a2;
      if( !v19 )
        v19 = (**v17)[1] - a2[1];
      if( !v19 )
      {
        LOBYTE(LoggerId) = v15;
        return EtwpEnableDisableUMGL((UINT8)SiloState, LoggerId, v9, (unsigned int)UMGLProviderIndex);
      }
      ++v16;
      v17 += 2;
    }
    while( v16 < 0xA );
    v20 = KernelRundownGuid - v18;
    if( KernelRundownGuid == v18 )
      v20 = 0xCDF584518E9C7793ui64 - a2[1];
    if( v20 )
      goto LABEL_12;
    if( v15 == 1 )
    {
      switch( (_DWORD)UMGLProviderIndex )
      {
        case 1:
          LoggerId = SiloState->SystemLoggerSettings.EtwpSystemLogger[0].LoggerId;
          break;
        case 2:
          LoggerId = SiloState->SystemLoggerSettings.EtwpSystemLogger[0].LoggerId;
          return EtwpCheckLoggerAccessAndDoRundown(SiloState, LoggerId, v9, v14);
        case 4:
          break;
        default:
          if( (_DWORD)UMGLProviderIndex != 8 && (_DWORD)UMGLProviderIndex == 16 )
            return EtwpLogFileNameRundown((UINT64)SiloState);
          return EtwpCheckLoggerAccessAndDoRundown(SiloState, LoggerId, v9, v14);
      }
      v14 = 1;
      return EtwpCheckLoggerAccessAndDoRundown(SiloState, LoggerId, v9, v14);
    }
    return 0;
  }
  v22 = *(_QWORD *)&SystemTraceControlGuid.Data1 - *a2;
  if( *(_QWORD *)&SystemTraceControlGuid.Data1 == *a2 )
    v22 = *(_QWORD *)SystemTraceControlGuid.Data4 - a2[1];
  v23 = 0;
  if( v22 || SiloState != (_ETW_SILODRIVERSTATE *)EtwpHostSiloState )
  {
LABEL_12:
    *(_BYTE *)a8 = 0;
    return v12;
  }
  if( (_DWORD)UMGLProviderIndex == 1 )
    goto LABEL_23;
  if( (_DWORD)UMGLProviderIndex == 2 )
  {
    v8 = 0;
LABEL_23:
    LODWORD(v25) = a7;
    return EtwpCheckGuidAccessAndDoRundown(SiloState, 2i64, v9, v8, a6, v25);
  }
  return v23;
}

Referenced by: