PfpLogApplicationEvent

INT64 __fastcall PfpLogApplicationEvent(__int64 a1, __int64 a2, char a3){
  int v5; 
  int v6; 
  __int64 v7; 
  _SECTION *v8; 
  int v9; 
  unsigned __int16 *v10; 
  __int64 v11; 
  __int64 v12; 
  unsigned int v13; 
  __int64 v14; 
  int SessionId; 
  UINT64 v16; 
  INT64 v17; 
  __int64 v19; 
  int v20; 
  _QWORD v21[3]; 
  __int64 v22; 
  __int64 SessionGlobalVA; 
  PVOID v24; 
  int v25; 
  int v26; 
  __int64 v27; 
  __int64 v28; 
  __int64 v29; 
  int v30; 
  unsigned __int16 v31; 
  UINT8 dst[1978]; 
  __int64 v33; 
  *(_OWORD *)&v21[1] = 0i64;
  if( dword_140C4FB18 >= (unsigned int)dword_140C4FB1C )
    return 3221225659i64;
  v5 = *(_DWORD *)(a1 + 1088);
  v6 = 0;
  v7 = *(_QWORD *)(a1 + 1128);
  v33 = 0i64;
  if( a3 )
  {
    v19 = *(_QWORD *)(a1 + 1088) ^ v7;
    LODWORD(v24) = v5;
    v22 = a1;
    v20 = *(_DWORD *)(a1 + 1524);
    SessionGlobalVA = v19 & 0x1FFFFFFFFFFFFFFFi64;
    v17 = 14i64;
    HIDWORD(v24) = v20;
    v16 = 24i64;
  }
  else
  {
    v26 = v5;
    v8 = (_SECTION *)&v21[1];
    HIDWORD(v22) = 0;
    v30 = 0;
    *(_WORD *)dst = 0;
    if( a2 )
      v8 = (_SECTION *)a2;
    v29 = a1;
    v9 = *(_DWORD *)(a1 + 1524);
    v27 = (*(_QWORD *)(a1 + 1088) ^ v7) & 0x1FFFFFFFFFFFFFFFi64;
    v25 = v9;
    MmGetDirectoryFrameFromProcess((_EPROCESS *)a1, v8, 0);
    v11 = *v10;
    v12 = *((_QWORD *)v10 + 1);
    v13 = v11;
    v28 = v14;
    if( (unsigned int)v11 > 0x7C0 )
      v13 = 1984;
    v31 = v13 >> 1;
    memmove(dst, (UINT8 *)(v11 + v12 - v13), v13);
    *(_WORD *)&dst[2 * v31] = 0;
    SessionId = MmGetSessionIdEx(a1);
    if( SessionId != -1 )
      v6 = SessionId;
    LODWORD(v22) = v6;
    SessionGlobalVA = MmGetSessionGlobalVA(a1);
    v16 = v13 + 64;
    v17 = 1i64;
    v24 = PsIdleProcess;
  }
  return PfLogEvent(
           v17,
           dword_140C5001C
         + (unsigned int)((((KUSER_SHARED_DATA.TickCountMultiplier
                           * (unsigned __int64)KUSER_SHARED_DATA.ReservedTickCountOverlay[1]) << 8)
                         + ((KUSER_SHARED_DATA.TickCountMultiplier
                           * (unsigned __int64)KUSER_SHARED_DATA.TickCount.LowPart) >> 24)) >> 10),
           &v22,
           v16);
}

Referenced by: