MiLogHotPatchOperation
VOID __stdcall MiLogHotPatchOperation(INT64 a1, INT64 a2, INT64 a3, INT64 a4, INT64 *a5, UINT16 *a6, INT64 a7){
int v7;
int v8;
int v9;
__int64 v11;
_EPROCESS *v12;
int v13;
__int64 v14;
int v15;
int v16;
unsigned int ProcessId;
int v18;
int v19;
int v20;
int v21;
int v22;
int v23;
int v24;
int v25;
int v26;
int v27;
int v28;
INT8 *ImageFileName;
UINT64 Key;
__int64 v31;
__int64 v32;
__int64 v33[6];
INT64 v34[19];
int v35[2];
int *v36;
__int64 v37;
int *v38;
__int64 v39;
int *v40;
__int64 v41;
int *v42;
__int64 v43;
__int64 v44;
int v45[2];
int *v46;
__int64 v47;
int *v48;
__int64 v49;
__int64 *v50;
__int64 v51;
v7 = a4;
v8 = a3;
v9 = a2;
ImageFileName = 0i64;
if( *(&stru_140C4DB30 + 542) )
{
MiFillLogProcessInfo(&KeGetCurrentThread()->ApcState.Process->Vm.Instance, &Key, &ImageFileName);
v11 = *(&stru_140C4DB30 + 542);
if( **(&stru_140C4DB30 + 542) > 5u )
{
if( tlgKeywordOn(*(&stru_140C4DB30 + 542), 0x400000000020i64) )
{
ProcessId = (unsigned int)PsGetProcessId(v12);
v33[4] = (__int64)&ProcessId;
v33[5] = 4i64;
tlgCreate1Sz_char((INT64)v34, ImageFileName);
v34[2] = (INT64)&v18;
v31 = *(_QWORD *)(a1 + 24);
v34[4] = (INT64)&v31;
v34[6] = (INT64)&v19;
v34[8] = (INT64)&v20;
v21 = *(_DWORD *)(a1 + 88);
v34[10] = (INT64)&v21;
v22 = *(_DWORD *)(a1 + 80);
v34[12] = (INT64)&v22;
v23 = *(_DWORD *)(a1 + 84);
v34[14] = (INT64)&v23;
v34[16] = (INT64)v35;
v34[18] = *(_QWORD *)(a1 + 72);
v35[0] = *(unsigned __int16 *)(a1 + 64);
v36 = &v24;
v18 = a7;
v34[3] = 4i64;
v34[5] = 8i64;
v19 = v9;
v25 = *(_DWORD *)a5;
v38 = &v25;
v26 = *((_DWORD *)a5 + 1);
v40 = &v26;
v42 = v45;
v44 = *((_QWORD *)a6 + 1);
v45[0] = *a6;
v27 = *(_DWORD *)(a1 + 32);
v46 = &v27;
v13 = *(_DWORD *)(a1 + 92) >> 1;
v34[7] = 4i64;
v20 = v8;
v34[9] = 4i64;
v34[11] = 4i64;
v34[13] = 4i64;
v34[15] = 4i64;
v34[17] = 2i64;
v35[1] = 0;
v24 = v7;
v37 = 4i64;
v39 = 4i64;
v41 = 4i64;
v43 = 2i64;
v45[1] = 0;
v47 = 4i64;
v49 = 4i64;
v51 = 8i64;
v28 = v13 & 1;
v48 = &v28;
v32 = 2164260864i64;
v50 = &v32;
tlgWriteEx_EtwWriteEx(v11, (unsigned __int8 *)&byte_140025667, v14, 1u, v15, v16, 0x15u, (__int64)v33);
}
}
}
}Referenced by:
MiHotPatchImage