EtwTimLogUserCetSetContextIpValidationFailure

unsigned __int8 __fastcall EtwTimLogUserCetSetContextIpValidationFailure(
        int a1,
        _EPROCESS *a2,
        void *a3,
        int a4,
        int a5){
  _OBJECT_NAME_INFORMATION *ImageFileName; 
  __int64 *v6; 
  const wchar_t *v7; 
  unsigned __int16 v9; 
  unsigned int v10; 
  int v11; 
  const wchar_t *v12; 
  wchar_t *Buffer; 
  int Length; 
  __int16 v15; 
  unsigned int v16; 
  unsigned __int16 *Pool2; 
  unsigned __int16 *v18; 
  unsigned __int16 v19; 
  __int64 v20; 
  __int64 v21; 
  __int64 v22; 
  const _EVENT_DESCRIPTOR *v23; 
  unsigned int v24; 
  int v25; 
  __int64 v26; 
  __int64 v27; 
  ULONG v28; 
  REGHANDLE v29; 
  unsigned __int8 result; 
  unsigned __int16 *v31; 
  __int16 v32[2]; 
  __int16 v33[2]; 
  __int16 v34[2]; 
  int v35; 
  int v36; 
  PVOID BaseAddress; 
  __int64 v38; 
  __int64 v39; 
  __int64 v40; 
  _UNICODE_STRING CommandLine; 
  _EVENT_DATA_DESCRIPTOR v42; 
  int *v43; 
  __int64 v44; 
  int *v45; 
  __int64 v46; 
  __int64 v47; 
  int v48[2]; 
  int *v49; 
  __int64 v50; 
  wchar_t *v51; 
  int v52[2]; 
  __int64 *v53; 
  __int64 v54; 
  int *v55; 
  __int64 v56; 
  __int64 v57; 
  int v58[2]; 
  int *v59; 
  __int64 v60; 
  PVOID *p_BaseAddress; 
  __int64 v62; 
  __int64 *v63; 
  __int64 v64; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  const wchar_t *v66; 
  int v67; 
  int v68; 
  __int16 *v69; 
  __int64 v70; 
  wchar_t *v71; 
  int v72; 
  int v73; 
  __int64 v74[20]; 
  int v75; 

  v75 = a4;
  ImageFileName = a2->SeAuditProcessCreationInfo.ImageFileName;
  v6 = &EmptyUnicodeString;
  v36 = a1;
  v38 = 0i64;
  BaseAddress = a3;
  if( ImageFileName )
    v6 = (__int64 *)ImageFileName;
  v7 = L"(null)";
  CommandLine = 0i64;
  v9 = *(_WORD *)v6;
  v10 = 12;
  *(_QWORD *)&UserData.Size = 2i64;
  if( v9 )
  {
    v32[0] = v9 >> 1;
    UserData.Ptr = (unsigned __int64)v32;
    v11 = *(unsigned __int16 *)v6;
    v12 = (const wchar_t *)v6[1];
  }
  else
  {
    v32[0] = 6;
    UserData.Ptr = (unsigned __int64)v32;
    v12 = L"(null)";
    v11 = 12;
  }
  v66 = v12;
  v67 = v11;
  v68 = 0;
  EtwpQueryProcessCommandLine(a2, &CommandLine);
  Buffer = CommandLine.Buffer;
  LOWORD(v35) = CommandLine.Length;
  v70 = 2i64;
  if( CommandLine.Length )
  {
    v71 = CommandLine.Buffer;
    v69 = v34;
    Length = CommandLine.Length;
    v15 = CommandLine.Length >> 1;
  }
  else
  {
    v71 = L"(null)";
    v69 = v34;
    Length = 12;
    v15 = 6;
  }
  v72 = Length;
  v34[0] = v15;
  v73 = 0;
  v16 = EtwpTiFillProcessIdentity(v74, (__int64)a2, (unsigned __int64 *)&v38) + 4;
  Pool2 = (unsigned __int16 *)ExAllocatePool2(256i64, 0x200ui64, 0x6E734954ui64);
  v18 = Pool2;
  if( Pool2
    && (ZwQueryVirtualMemory(-1, BaseAddress, MemoryMappedFilenameInformation, Pool2, 512, 0i64) >= 0 ? (v19 = *v18) : (*v18 = 0, v19 = 0),
        v19) )
  {
    v33[0] = v19 >> 1;
    v20 = 2i64 * v16;
    *(&UserData.Ptr + v20) = (unsigned __int64)v33;
    *((_QWORD *)&UserData.Size + v20) = 2i64;
    v10 = *v18;
    v7 = (const wchar_t *)*((_QWORD *)v18 + 1);
  }
  else
  {
    v33[0] = 6;
    v21 = 2i64 * v16;
    *(&UserData.Ptr + v21) = (unsigned __int64)v33;
    *((_QWORD *)&UserData.Size + v21) = 2i64;
  }
  v22 = 2i64 * (v16 + 1);
  v23 = (const _EVENT_DESCRIPTOR *)MITIGATION_AUDIT_USER_CET_SET_CONTEXT_IP_VALIDATION_FAILURE;
  v24 = v16 + 2;
  *(&UserData.Ptr + v22) = (unsigned __int64)v7;
  *(&UserData.Size + 2 * v22) = v10;
  *(&UserData.Reserved + 2 * v22) = 0;
  v25 = v36;
  v26 = 2i64 * v24++;
  *(&UserData.Ptr + v26) = (unsigned __int64)&v75;
  *((_QWORD *)&UserData.Size + v26) = 4i64;
  v27 = 2i64 * v24;
  v28 = v24 + 1;
  *(&UserData.Ptr + v27) = (unsigned __int64)&a5;
  v29 = *(&ExBootDevicesRemovedEvent + 248);
  *((_QWORD *)&UserData.Size + v27) = 4i64;
  if( v25 != 1 )
    v23 = &MITIGATION_ENFORCE_USER_CET_SET_CONTEXT_IP_VALIDATION_FAILURE;
  result = EtwWrite(v29, v23, 0, v28, &UserData);
  if( *(&stru_140C00F40 + 1820) > 5u )
  {
    result = tlgKeywordOn((__int64)&stru_140C00F40 + 7280, 0x400000000000i64);
    if( result )
    {
      v36 = v25;
      v43 = &v36;
      v44 = 4i64;
      v45 = v48;
      v47 = v6[1];
      v48[0] = *(unsigned __int16 *)v6;
      v49 = v52;
      v52[0] = (unsigned __int16)v35;
      v39 = v38;
      v53 = &v39;
      v55 = v58;
      v57 = *((_QWORD *)v31 + 1);
      v58[0] = *v31;
      v35 = v75;
      v59 = &v35;
      LODWORD(BaseAddress) = a5;
      p_BaseAddress = &BaseAddress;
      v63 = &v40;
      v46 = 2i64;
      v48[1] = 0;
      v50 = 2i64;
      v51 = Buffer;
      v52[1] = 0;
      v54 = 8i64;
      v56 = 2i64;
      v58[1] = 0;
      v60 = 4i64;
      v62 = 4i64;
      v40 = 0x1000000i64;
      v64 = 8i64;
      result = tlgWriteTransfer_EtwWriteTransfer(
                 (__int64)&stru_140C00F40 + 7280,
                 (unsigned __int8 *)byte_14002C565,
                 0i64,
                 0i64,
                 0xDu,
                 &v42);
    }
  }
  if( Buffer )
    result = (unsigned __int8)ExFreePoolWithTag(Buffer, 0);
  if( v18 )
    return(unsigned __int8)ExFreePoolWithTag(v18, 0);
  return result;
}

Referenced by: