EtwpEnableDisableSpecialGuids

INT64 __fastcall EtwpEnableDisableSpecialGuids(
        _ETW_SILODRIVERSTATE *SiloState,
        const _GUID *Guid,
        UINT16 LoggerId,
        UINT64 ControlCode,
        UINT64 Flags,
        _EVENT_FILTER_DESCRIPTOR *FilterDescriptor,
        UINT8 *Found){
  char v7; 
  int v8; 
  unsigned int v9; 
  _EVENT_FILTER_DESCRIPTOR *v10; 
  unsigned int v13; 
  UINT64 v14; 
  UINT8 v15; 
  char v16; 
  unsigned int v17; 
  INT64(__fastcall *v18)(INT64, __m128i *, UINT64, _QWORD *); 
  __int64 v19; 
  __int64 v20; 
  unsigned __int64 v21; 
  __int64 v23; 
  unsigned int v24; 
  _BYTE *v26; 
  v7 = 1;
  v8 = ControlCode;
  v9 = LoggerId;
  v10 = (_EVENT_FILTER_DESCRIPTOR *)(unsigned int)Flags;
  v13 = -1073741275;
  v14 = 2i64;
  *v26 = 1;
  if( v8 != 2 )
  {
    v15 = 0;
    if( v8 == 1 )
    {
      v16 = 1;
    }
    else
    {
      if( v8 )
        goto LABEL_12;
      v16 = 0;
    }
    v17 = 0;
    v18 = EtwpUmglProviders;
    do
    {
      v19 = *(_QWORD *)&Guid->Data1;
      v20 = **(_QWORD **)v18 - *(_QWORD *)&Guid->Data1;
      if( !v20 )
        v20 = *(_QWORD *)(*(_QWORD *)v18 + 8i64) - *(_QWORD *)Guid->Data4;
      if( !v20 )
      {
        LOBYTE(v14) = v16;
        return EtwpEnableDisableUMGL((UINT8)SiloState, v14, v9, (unsigned int)Flags);
      }
      ++v17;
      v18 = (INT64(__fastcall *)(INT64, __m128i *, UINT64, _QWORD *))((char *)v18 + 16);
    }
    while( v17 < 0xA );
    v21 = KernelRundownGuid - v19;
    if( KernelRundownGuid == v19 )
      v21 = 0xCDF584518E9C7793ui64 - *(_QWORD *)Guid->Data4;
    if( v21 )
      goto LABEL_12;
    if( v16 == 1 )
    {
      switch( (_DWORD)Flags )
      {
        case 1:
          v14 = SiloState->SystemLoggerSettings.EtwpSystemLogger[0].LoggerId;
          break;
        case 2:
          v14 = SiloState->SystemLoggerSettings.EtwpSystemLogger[0].LoggerId;
          return(unsigned int)EtwpCheckLoggerAccessAndDoRundown(SiloState, v14, v9, v15);
        case 4:
          break;
        default:
          if( (_DWORD)Flags != 8 && (_DWORD)Flags == 16 )
            return(unsigned int)EtwpLogFileNameRundown((UINT64)SiloState);
          return(unsigned int)EtwpCheckLoggerAccessAndDoRundown(SiloState, v14, v9, v15);
      }
      v15 = 1;
      return(unsigned int)EtwpCheckLoggerAccessAndDoRundown(SiloState, v14, v9, v15);
    }
    return 0;
  }
  v23 = *(_QWORD *)&SystemTraceControlGuid.Data1 - *(_QWORD *)&Guid->Data1;
  if( *(_QWORD *)&SystemTraceControlGuid.Data1 == *(_QWORD *)&Guid->Data1 )
    v23 = *(_QWORD *)SystemTraceControlGuid.Data4 - *(_QWORD *)Guid->Data4;
  v24 = 0;
  if( v23 || SiloState != (_ETW_SILODRIVERSTATE *)EtwpHostSiloState )
  {
LABEL_12:
    *v26 = 0;
    return v13;
  }
  if( (_DWORD)Flags == 1 )
    goto LABEL_23;
  if( (_DWORD)Flags == 2 )
  {
    v7 = 0;
LABEL_23:
    LOBYTE(v10) = v7;
    return(unsigned int)EtwpCheckGuidAccessAndDoRundown(SiloState, (const _GUID *)2, v9, v10, (UINT8)FilterDescriptor);
  }
  return v24;
}

Referenced by: