EtwpTimLogMitigationForProcess

VOID __fastcall EtwpTimLogMitigationForProcess(INT64 a1, INT64 a2, const EVENT_DESCRIPTOR *r8_0, INT64 a4){
  __int64 *v4; 
  __int64 *v5; 
  int v6; 
  int v8; 
  const wchar_t *v10; 
  int v11; 
  unsigned __int16 v12; 
  int v13; 
  const wchar_t *v14; 
  __int16 v15; 
  int v16; 
  int v17; 
  int v18; 
  PVOID v19; 
  __int16 v20[2]; 
  __int16 v21; 
  int v22; 
  int v23; 
  UINT64 a3; 
  PVOID P[2]; 
  UINT64 v26; 
  struct _EVENT_DATA_DESCRIPTOR v27; 
  int *v28; 
  __int64 v29; 
  int *v30; 
  __int64 v31; 
  int *v32; 
  __int64 v33; 
  __int64 v34; 
  int v35[2]; 
  int *v36; 
  __int64 v37; 
  PVOID v38; 
  int v39[2]; 
  UINT64 *v40; 
  __int64 v41; 
  EVENT_DATA_DESCRIPTOR UserData; 
  const wchar_t *v43; 
  int v44; 
  int v45; 
  __int16 *v46; 
  __int64 v47; 
  const wchar_t *v48; 
  int v49; 
  int v50; 
  __int64 v51[16]; 
  v4 = *(__int64 **)(a4 + 1472);
  v5 = &EmptyUnicodeString;
  v6 = a2;
  a3 = 0i64;
  v8 = a1;
  if( v4 )
    v5 = v4;
  v10 = L"(null)";
  *(_OWORD *)P = 0i64;
  v11 = 12;
  v12 = *(_WORD *)v5;
  *(_QWORD *)&UserData.Size = 2i64;
  if( v12 )
  {
    v20[0] = v12 >> 1;
    UserData.Ptr = (unsigned __int64)v20;
    v13 = *(unsigned __int16 *)v5;
    v10 = (const wchar_t *)v5[1];
  }
  else
  {
    v20[0] = 6;
    UserData.Ptr = (unsigned __int64)v20;
    v13 = 12;
  }
  v43 = v10;
  v45 = 0;
  v44 = v13;
  EtwpQueryProcessCommandLine((_EPROCESS *)a4, (_UNICODE_STRING *)P);
  v47 = 2i64;
  v46 = &v21;
  if( LOWORD(P[0]) )
  {
    v14 = (const wchar_t *)P[1];
    v11 = LOWORD(P[0]);
    v15 = LOWORD(P[0]) >> 1;
  }
  else
  {
    v14 = L"(null)";
    v15 = 6;
  }
  v21 = v15;
  v50 = 0;
  v48 = v14;
  v49 = v11;
  v16 = EtwpTiFillProcessIdentity(v51, a4, &a3);
  v17 = EtwpTiFillThreadIdentity((INT64)(&UserData + (unsigned int)(v16 + 4)), (INT64)KeGetCurrentThread());
  EtwWrite(EtwSecurityMitigationsRegHandle, (EVENT_DESCRIPTOR *)r8_0, 0i64, (unsigned int)(v17 + v18), &UserData);
  v19 = P[1];
  if( (unsigned int)dword_140C02BB0 > 5 && tlgKeywordOn((__int64)&dword_140C02BB0, 0x200000000000i64) )
  {
    v22 = v8;
    v28 = &v22;
    v29 = 4i64;
    v30 = &v23;
    v23 = v6;
    v32 = v35;
    v34 = v5[1];
    v35[0] = *(unsigned __int16 *)v5;
    v36 = v39;
    v39[0] = LOWORD(P[0]);
    v26 = a3;
    v40 = &v26;
    v31 = 4i64;
    v33 = 2i64;
    v35[1] = 0;
    v37 = 2i64;
    v38 = v19;
    v39[1] = 0;
    v41 = 8i64;
    tlgWriteTransfer_EtwWriteTransfer(
      (__int64)&dword_140C02BB0,
      (unsigned __int8 *)word_14002C73A,
      0i64,
      0i64,
      9u,
      &v27);
  }
  if( v19 )
    ExFreePoolWithTag(v19, 0);
}

Referenced by: