EtwLogPfnInfoRundown

__int64 __fastcall EtwLogPfnInfoRundown(__int64 a1, UINT64 a2, int a3, __int64 *a4){
  __int64 v6; 
  __int64 *v7; 
  unsigned __int64 v8; 
  __int64 *v9; 
  __int64 result; 
  __int64 v11; 
  UINT64 Flag; 
  UINT64 v13; 
  EVENT_DATA_DESCRIPTOR EventData; 
  __int64 *v15; 
  int i; 
  int v17; 
  __int64 *v18; 
  int v19; 
  int v20; 
  if( a1 )
    v6 = *(unsigned int *)(a1 + 1088);
  else
    v6 = 0xFFFFFFFFi64;
  *a4 = v6;
  v7 = a4 + 1;
  v8 = a4[1];
  v9 = a4 + 2;
  EventData.Reserved = 0;
  result = 8i64;
  v17 = 0;
  EventData.Ptr = (unsigned __int64)a4;
  EventData.Size = 8;
  v15 = a4 + 1;
  for( i = 8; v8; v8 -= *v7 )
  {
    LODWORD(v13) = 4200450;
    v11 = v8;
    v18 = v9;
    if( v8 > 0x7FC )
      v11 = 2044i64;
    v20 = 0;
    *v7 = v11;
    v19 = 32 * v11;
    LOWORD(Flag) = 644;
    EtwpLogKernelEvent(&EventData, a2, (unsigned int)a3, 3u, Flag, v13);
    result = 32 * *v7;
    v9 = (__int64 *)((char *)v9 + result);
  }
  return result;
}

Referenced by: