Did I understand correctly that you want NULL in case there is an IN mark but not OUT.
For such query something like:
SELECT l1.*, NULL as overtime
FROM Log_Attendance l1
WHERE l1.ModeEvent = 4
AND 5 <> (SELECT ModeEvent
FROM Log_Attendance l2
WHERE l2.EnrollNumber = l1.EnrollNumber
AND l2.TImesInOut = (SELECT MIN(L3.TImesInOut)
FROM Log_Attendance l3
WHERE l3.EnrollNumber = l1.EnrollNumber
AND L3.TImesInOut > l1.TimesInOut))
You can switch the condition vice versa if you want to have the rows with out mark but no corresponding in mark and use UNION to combine the result sets.
ADDITION
Something like this?
SELECT EnrollNumber,
'' AS desription,
DATEDIFF(hour, l2.TimesInOout, l1.TimesInOut) as time
FROM Log_Attendance l1,
Log_Attendance l2
WHERE l1.ModeEvent = 4
AND l2.ModeEvent = 5
AND l1.EnrollNumber = l2.EnrollNumber
AND l2.TImesInOut = (SELECT MIN(L3.TImesInOut)
FROM Log_Attendance l3
WHERE l3.EnrollNumber = l1.EnrollNumber
AND L3.TImesInOut > l1.TimesInOut))
UNION ALL
SELECT EnrollNumber,
'End time missing' AS desription,
NULL as time
FROM Log_Attendance l1
WHERE l1.ModeEvent = 4
AND 5 <> (SELECT ModeEvent
FROM Log_Attendance l2
WHERE l2.EnrollNumber = l1.EnrollNumber
AND l2.TImesInOut = (SELECT MIN(L3.TImesInOut)
FROM Log_Attendance l3
WHERE l3.EnrollNumber = l1.EnrollNumber
AND L3.TImesInOut > l1.TimesInOut))