EtwTiLogProtectExecVm

UINT8 EtwTiLogProtectExecVm(__int64 a1, char a2, ...){
  UINT8 result; 
  __int64 v5; 
  _EPROCESS *Process; 
  _ETHREAD *CurrentThread; 
  __int64 v8; 
  const _EVENT_DESCRIPTOR *v9; 
  int v10; 
  NTSTATUS v11; 
  int v12; 
  int v13; 
  int v14; 
  int v15; 
  int v16; 
  unsigned int v17; 
  __int64 v18; 
  __int64 v19; 
  __int64 v20; 
  __int64 v21; 
  REGHANDLE v22; 
  unsigned __int64 v23; 
  unsigned __int64 v24; 
  unsigned __int64 v25; 
  _EVENT_DATA_DESCRIPTOR UserData[24]; 
  __int64 v27; 
  va_list va; 
  __int64 v29; 
  va_list va1; 
  __int64 v31; 
  va_list va2; 
  va_list va3; 

  va_start(va3, a2);
  va_start(va2, a2);
  va_start(va1, a2);
  va_start(va, a2);
  v27 = va_arg(va1, _QWORD);
  va_copy(va2, va1);
  v29 = va_arg(va2, _QWORD);
  va_copy(va3, va2);
  v31 = va_arg(va3, _QWORD);
  result = EtwProviderEnabled(*(&ExBootDevicesRemovedEvent + 179), 0, 0xF0ui64);
  if( result )
  {
    v5 = 0i64;
    Process = KeGetCurrentThread()->ApcState.Process;
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    if( Process == (_EPROCESS *)a1 )
      v5 = 8i64;
    v8 = (__int64)CurrentThread->Tcb.Process;
    v9 = *(const _EVENT_DESCRIPTOR **)((char *)off_140006640 + (a2 != 0 ? 0 : 0x10) + v5);
    result = EtwEventEnabled(*(&ExBootDevicesRemovedEvent + 179), v9);
    if( result )
    {
      v10 = EtwpTiFillProcessIdentity((_QWORD *)UserData, (__int64)Process, &v23);
      v11 = EtwpTiFillThreadIdentity((INT64)&UserData[v10], (INT64)KeGetCurrentThread());
      v13 = EtwpTiFillProcessIdentity(&UserData[v11 + v12].Ptr, a1, &v24);
      v15 = EtwpTiFillProcessIdentity(&UserData[v13 + v14].Ptr, v8, &v25);
      v17 = v15 + v16;
      v18 = v17;
      UserData[v18].Reserved = 0;
      UserData[v18].Ptr = (unsigned __int64)va;
      UserData[v18].Size = 8;
      v19 = v17 + 1;
      UserData[v19].Reserved = 0;
      UserData[v19].Ptr = (unsigned __int64)va1;
      UserData[v19].Size = 8;
      v20 = v17 + 2;
      v17 += 3;
      v20 *= 2i64;
      *(&UserData[0].Reserved + 2 * v20) = 0;
      *(&UserData[0].Ptr + v20) = (unsigned __int64)va2;
      *(&UserData[0].Size + 2 * v20) = 4;
      v21 = v17;
      UserData[v21].Reserved = 0;
      UserData[v21].Ptr = (unsigned __int64)va3;
      v22 = *(&ExBootDevicesRemovedEvent + 179);
      UserData[v21].Size = 4;
      return EtwWrite(v22, v9, 0, v17 + 1, UserData);
    }
  }
  return result;
}

Referenced by: