TtmiLogExitProximity
VOID __stdcall TtmiLogExitProximity(UINT64 ScenarioCount, UINT64 EscapeCount, UINT8 Escaped){
int v4;
int v5;
NTSTATUS ProcessSessionId;
UINT8 v7;
NTSTATUS v8;
int v9;
int v10;
_EVENT_DATA_DESCRIPTOR v11;
int *v12;
int v13;
int v14;
int *v15;
int v16;
int v17;
int *v18;
int v19;
int v20;
UINT8 *v21;
int v22;
int v23;
v4 = EscapeCount;
v5 = ScenarioCount;
if( (unsigned int)dword_140D2C8E8 > 5 )
{
if( tlgKeywordOn((__int64)&dword_140D2C8E8, 1i64) )
{
ProcessSessionId = PsGetProcessSessionIdEx((INT64)KeGetCurrentThread()->ApcState.Process);
v14 = 0;
v17 = 0;
v20 = 0;
v23 = 0;
v8 = ProcessSessionId;
v12 = &v8;
v15 = &v9;
v18 = &v10;
v21 = &v7;
v13 = 4;
v16 = 4;
v19 = 4;
v9 = v5;
v10 = v4;
v7 = Escaped;
v22 = 1;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&dword_140D2C8E8,
(unsigned __int8 *)&unk_14002A990,
0i64,
0i64,
6u,
&v11);
}
}
}Referenced by:
TtmpExitProximity