MiLogHotPatchOperation
CHAR __fastcall MiLogHotPatchOperation(INT64 a1, INT64 a2, INT64 a3, INT64 a4, INT64 *a5, UINT16 *a6, INT64 a7){
void **v7;
int v8;
int v9;
int v10;
__int64 v12;
_EPROCESS *v13;
int v14;
__int64 v15;
int v17;
int v18;
unsigned int ProcessId;
int v20;
int v21;
int v22;
int v23;
int v24;
int v25;
int v26;
int v27;
int v28;
int v29;
int v30;
CHAR *ImageFileName;
UINT Key;
__int64 v33;
__int64 v34;
__int64 v35[6];
char v36[16];
int *v37;
__int64 v38;
__int64 *v39;
__int64 v40;
int *v41;
__int64 v42;
int *v43;
__int64 v44;
int *v45;
__int64 v46;
int *v47;
__int64 v48;
int *v49;
__int64 v50;
int *v51;
__int64 v52;
__int64 v53;
int v54[2];
int *v55;
__int64 v56;
int *v57;
__int64 v58;
int *v59;
__int64 v60;
int *v61;
__int64 v62;
__int64 v63;
int v64[2];
int *v65;
__int64 v66;
int *v67;
__int64 v68;
__int64 *v69;
__int64 v70;
void *retaddr;
v7 = &retaddr;
v8 = a4;
v9 = a3;
v10 = a2;
ImageFileName = 0i64;
if( *(_QWORD *)&qword_140C4EC20 )
{
MiFillLogProcessInfo(
(_MMSUPPORT_INSTANCE *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1664i64),
&Key,
&ImageFileName);
v12 = *(_QWORD *)&qword_140C4EC20;
if( **(_DWORD **)&qword_140C4EC20 > 5u )
{
LOBYTE(v7) = tlgKeywordOn(*(__int64 *)&qword_140C4EC20, 0x400000000020i64);
if( (_BYTE)v7 )
{
ProcessId = (unsigned int)PsGetProcessId((PEPROCESS)v13);
v35[4] = (__int64)&ProcessId;
v35[5] = 4i64;
tlgCreate1Sz_char((__int64)v36, ImageFileName);
v37 = &v20;
v33 = *(_QWORD *)(a1 + 24);
v39 = &v33;
v41 = &v21;
v43 = &v22;
v23 = *(_DWORD *)(a1 + 88);
v45 = &v23;
v24 = *(_DWORD *)(a1 + 80);
v47 = &v24;
v25 = *(_DWORD *)(a1 + 84);
v49 = &v25;
v51 = v54;
v53 = *(_QWORD *)(a1 + 72);
v54[0] = *(unsigned __int16 *)(a1 + 64);
v55 = &v26;
v20 = a7;
v38 = 4i64;
v40 = 8i64;
v21 = v10;
v27 = *(_DWORD *)a5;
v57 = &v27;
v28 = *((_DWORD *)a5 + 1);
v59 = &v28;
v61 = v64;
v63 = *((_QWORD *)a6 + 1);
v64[0] = *a6;
v29 = *(_DWORD *)(a1 + 32);
v65 = &v29;
v14 = *(_DWORD *)(a1 + 92) >> 1;
v42 = 4i64;
v22 = v9;
v44 = 4i64;
v46 = 4i64;
v48 = 4i64;
v50 = 4i64;
v52 = 2i64;
v54[1] = 0;
v26 = v8;
v56 = 4i64;
v58 = 4i64;
v60 = 4i64;
v62 = 2i64;
v64[1] = 0;
v66 = 4i64;
v68 = 4i64;
v70 = 8i64;
v30 = v14 & 1;
v67 = &v30;
v34 = 2164260864i64;
v69 = &v34;
LOBYTE(v7) = tlgWriteEx_EtwWriteEx(
v12,
(unsigned __int8 *)&byte_140025667,
v15,
1u,
v17,
v18,
0x15u,
(__int64)v35);
}
}
}
return(char)v7;
}Referenced by:
MiHotPatchImage