KiTraceLogNmiCallback

VOID __fastcall KiTraceLogNmiCallback(UINT64 a1, INT64 a2, WCHAR a3){
  BOOL v4; 
  __int64 v5; 
  int v6; 
  int v7; 
  int v8; 
  PVOID *i; 
  UINT64 v10; 
  int v11; 
  int v12; 
  int DestinationString; 
  struct _UNICODE_STRING DestinationString_8; 
  __int64 v15; 
  UINT64 v16; 
  struct _EVENT_DATA_DESCRIPTOR v17; 
  int *v18; 
  int v19; 
  int v20; 
  wchar_t *Buffer; 
  int v22[2]; 
  __int64 *v23; 
  int v24; 
  int v25; 
  int *v26; 
  int v27; 
  int v28; 
  int *v29; 
  int v30; 
  int v31; 
  int *p_DestinationString; 
  int v33; 
  int v34; 
  UINT64 *v35; 
  int v36; 
  int v37; 
  struct _UNICODE_STRING *p_DestinationString_8; 
  int v39; 
  int v40; 
  DestinationString_8 = 0i64;
  RtlInitUnicodeString(&DestinationString_8, (PCWSTR)&stru_1407D2340.Xmm13, a3);
  v5 = -1i64;
  v6 = 0;
  v7 = 0;
  v8 = 0;
  if( (a1 < PsNtosImageBase || a1 >= PsNtosImageEnd) && (a1 < (unsigned __int64)PsHalImageBase || a1 >= PsHalImageEnd) )
  {
    LOBYTE(v4) = 1;
    ExAcquireResourceSharedLite(&PsLoadedModuleResource, v4);
    for( i = (PVOID *)PsLoadedModuleList; i != &PsLoadedModuleList; i = (PVOID *)*i )
    {
      v10 = (UINT64)i[6];
      if( a1 >= v10 && a1 < v10 + *((unsigned int *)i + 16) )
      {
        v7 = *((_DWORD *)i + 30);
        v5 = (__int64)i[6];
        v8 = *((_DWORD *)i + 39);
        v6 = *((_DWORD *)i + 16);
        DestinationString_8 = *(struct _UNICODE_STRING *)(i + 9);
        break;
      }
    }
    if( (unsigned int)dword_140C01A70 > 5 )
    {
      if( tlgKeywordOn((__int64)&dword_140C01A70, 0x400000000000i64) )
      {
        v20 = 0;
        v22[1] = 0;
        v25 = 0;
        v28 = 0;
        v31 = 0;
        v34 = 0;
        v37 = 0;
        v40 = 0;
        v18 = v22;
        Buffer = DestinationString_8.Buffer;
        v22[0] = DestinationString_8.Length;
        v23 = &v15;
        v26 = &v11;
        v29 = &v12;
        p_DestinationString = &DestinationString;
        v35 = &v16;
        p_DestinationString_8 = &DestinationString_8;
        v24 = 8;
        v27 = 4;
        v30 = 4;
        v33 = 4;
        v36 = 8;
        v39 = 8;
        v19 = 2;
        v15 = v5;
        v11 = v6;
        v12 = v7;
        DestinationString = v8;
        v16 = a1;
        *(_QWORD *)&DestinationString_8.Length = 0x1000000i64;
        tlgWriteTransfer_EtwWriteTransfer(
          (__int64)&dword_140C01A70,
          (unsigned __int8 *)&word_140024926,
          0i64,
          0i64,
          0xAu,
          &v17);
      }
    }
    ExReleaseResourceLite(&PsLoadedModuleResource);
  }
}

Referenced by: