TtmiLogTerminalStateMachine

char __fastcall TtmiLogTerminalStateMachine(int a1, __int64 a2, int *a3){
  void **v3; 
  char v8; 
  char v9; 
  char v10; 
  NTSTATUS ProcessSessionId; 
  int v12; 
  int v13; 
  int v14; 
  int v15; 
  int v16; 
  int v17; 
  __int64 v18; 
  __int64 v19; 
  __int64 v20; 
  __int64 v21; 
  __int64 v22; 
  __int64 v23; 
  _EVENT_DATA_DESCRIPTOR v24; 
  NTSTATUS *p_ProcessSessionId; 
  __int64 v26; 
  int *v27; 
  __int64 v28; 
  int *v29; 
  __int64 v30; 
  __int64 *v31; 
  __int64 v32; 
  __int64 *v33; 
  __int64 v34; 
  __int64 *v35; 
  __int64 v36; 
  __int64 *v37; 
  __int64 v38; 
  char *v39; 
  __int64 v40; 
  char *v41; 
  __int64 v42; 
  int *v43; 
  __int64 v44; 
  int *v45; 
  __int64 v46; 
  int *v47; 
  __int64 v48; 
  char *v49; 
  __int64 v50; 
  int *v51; 
  __int64 v52; 
  __int64 *v53; 
  __int64 v54; 
  __int64 *v55; 
  __int64 v56; 
  void *retaddr; 

  v3 = &retaddr;
  if( (unsigned int)dword_140D2C8E8 > 5 )
  {
    LOBYTE(v3) = tlgKeywordOn((__int64)&dword_140D2C8E8, 1i64);
    if( (_BYTE)v3 )
    {
      ProcessSessionId = PsGetProcessSessionIdEx((INT64)KeGetCurrentThread()->ApcState.Process);
      p_ProcessSessionId = &ProcessSessionId;
      v27 = &v12;
      v13 = *(_DWORD *)a2;
      v29 = &v13;
      v18 = *(_QWORD *)(a2 + 8);
      v31 = &v18;
      v19 = *(_QWORD *)(a2 + 16);
      v33 = &v19;
      v20 = *(_QWORD *)(a2 + 24);
      v35 = &v20;
      v21 = *(_QWORD *)(a2 + 32);
      v37 = &v21;
      v8 = *(_BYTE *)(a2 + 40);
      v39 = &v8;
      v9 = *(_BYTE *)(a2 + 41);
      v41 = &v9;
      v14 = *(_DWORD *)(a2 + 44);
      v43 = &v14;
      v15 = *(_DWORD *)(a2 + 48);
      v45 = &v15;
      v16 = *a3;
      v47 = &v16;
      v10 = *((_BYTE *)a3 + 4);
      v49 = &v10;
      v17 = a3[2];
      v51 = &v17;
      v22 = *((_QWORD *)a3 + 2);
      v53 = &v22;
      v23 = *((_QWORD *)a3 + 3);
      v55 = &v23;
      v26 = 4i64;
      v12 = a1;
      v28 = 4i64;
      v30 = 4i64;
      v32 = 8i64;
      v34 = 8i64;
      v36 = 8i64;
      v38 = 8i64;
      v40 = 1i64;
      v42 = 1i64;
      v44 = 4i64;
      v46 = 4i64;
      v48 = 4i64;
      v50 = 1i64;
      v52 = 4i64;
      v54 = 8i64;
      v56 = 8i64;
      LOBYTE(v3) = tlgWriteTransfer_EtwWriteTransfer(
                     (__int64)&dword_140D2C8E8,
                     (unsigned __int8 *)&word_14002A6B6,
                     0i64,
                     0i64,
                     0x12u,
                     &v24);
    }
  }
  return(char)v3;
}

Referenced by: