MiLogPinDriverAddress

void __fastcall MiLogPinDriverAddress(_QWORD *a1){
  _ETHREAD *CurrentThread; 
  VOID *v3; 
  _LIST_ENTRY *v4; 
  int Blink; 
  wchar_t **p_Blink; 
  int Blink_high; 
  __int64 v8; 
  __int64 v9; 
  unsigned int v10; 
  unsigned int v11; 
  unsigned int v12; 
  unsigned int v13; 
  unsigned int v14; 
  unsigned int v15; 
  int v16; 
  unsigned int v17; 
  unsigned int v18; 
  int v19; 
  int v20; 
  __int64 v21; 
  _UNICODE_STRING DestinationString[2]; 
  _EVENT_DATA_DESCRIPTOR v23; 
  __int64 *v24; 
  __int64 v25; 
  int *v26; 
  __int64 v27; 
  int *v28; 
  __int64 v29; 
  int *v30; 
  __int64 v31; 
  int *v32; 
  __int64 v33; 
  int *v34; 
  __int64 v35; 
  int *v36; 
  __int64 v37; 
  int *v38; 
  __int64 v39; 
  int *v40; 
  __int64 v41; 
  int *v42; 
  __int64 v43; 
  wchar_t *v44; 
  int v45[2]; 
  int *v46; 
  __int64 v47; 
  int *v48; 
  __int64 v49; 
  _UNICODE_STRING *v50; 
  __int64 v51; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v3 = (VOID *)(*a1 & 0xFFFFFFFFFFFFF000ui64);
  *(_OWORD *)&DestinationString[0].Buffer = 0i64;
  --CurrentThread->Tcb.KernelApcDisable;
  ExAcquireResourceSharedLite((UINT64)&PsLoadedModuleResource, 1);
  v4 = MiLookupDataTableEntry(v3, 0i64);
  if( v4 )
  {
    Blink = (int)v4[7].Blink;
    p_Blink = (wchar_t **)&v4[5].Blink;
    Blink_high = HIDWORD(v4[9].Blink);
  }
  else
  {
    Blink = 0;
    Blink_high = 0;
    p_Blink = &DestinationString[0].Buffer;
    RtlInitUnicodeString((PUNICODE_STRING)&DestinationString[0].Buffer, L"Image not found");
  }
  if( **(&stru_140C4DB30 + 542) > 5u && tlgKeywordOn(*(&stru_140C4DB30 + 542), 0x400000000000i64) )
  {
    v10 = *(_DWORD *)a1;
    v24 = &v21;
    v21 = 1i64;
    v11 = (v10 >> 1) & 1;
    v26 = (int *)&v11;
    v25 = 8i64;
    v12 = (v10 >> 2) & 1;
    v28 = (int *)&v12;
    v27 = 4i64;
    v13 = (v10 >> 3) & 1;
    v30 = (int *)&v13;
    v29 = 4i64;
    v14 = (v10 >> 4) & 1;
    v32 = (int *)&v14;
    v31 = 4i64;
    v15 = (v10 >> 5) & 1;
    v34 = (int *)&v15;
    v33 = 4i64;
    v16 = (unsigned __int8)v10 >> 6;
    v36 = &v16;
    v17 = (v10 >> 10) & 3;
    v35 = 4i64;
    v38 = (int *)&v17;
    v40 = (int *)&v18;
    v42 = v45;
    v44 = p_Blink[1];
    v45[0] = *(unsigned __int16 *)p_Blink;
    v46 = &v19;
    v48 = &v20;
    *(_QWORD *)&DestinationString[0].Length = 2164260864i64;
    v50 = DestinationString;
    v37 = 4i64;
    v39 = 4i64;
    v18 = (v10 >> 8) & 3;
    v41 = 4i64;
    v43 = 2i64;
    v45[1] = 0;
    v19 = Blink;
    v47 = 4i64;
    v20 = Blink_high;
    v49 = 4i64;
    v51 = 8i64;
    tlgWriteAgg(v9, (unsigned __int8 *)&byte_1400259F0, v8, 0x10u, &v23);
  }
  ExReleaseResourceLite(&PsLoadedModuleResource);
  KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
}

Referenced by:

MiLogPinDriverAddressesWorker