EtwpTiFillVad
INT64 __fastcall EtwpTiFillVad(INT64 a1, INT64 a2){
__int64 v2;
__int64 *v3;
int v4;
INT64 result;
*(_QWORD *)a1 = a2;
*(_QWORD *)(a1 + 16) = a2 + 8;
*(_QWORD *)(a1 + 8) = 4i64;
*(_QWORD *)(a1 + 32) = a2 + 16;
*(_QWORD *)(a1 + 48) = a2 + 20;
*(_QWORD *)(a1 + 64) = a2 + 24;
*(_QWORD *)(a1 + 80) = a2 + 32;
*(_QWORD *)(a1 + 24) = 8i64;
*(_QWORD *)(a1 + 40) = 4i64;
*(_QWORD *)(a1 + 56) = 4i64;
*(_QWORD *)(a1 + 72) = 8i64;
*(_QWORD *)(a1 + 88) = 8i64;
v2 = *(_QWORD *)(a2 + 56);
if( v2 && (v3 = *(__int64 **)(v2 + 8)) != 0i64 && *(_WORD *)v2 )
{
v4 = *(unsigned __int16 *)(v2 + 2);
}
else
{
v4 = 2;
v3 = &qword_14003AA78;
}
*(_QWORD *)(a1 + 96) = v3;
result = 7i64;
*(_DWORD *)(a1 + 104) = v4;
*(_DWORD *)(a1 + 108) = 0;
return result;
}Referenced by:
EtwpTiFillVadEventWrite