EtwTimLogUserCetSetContextIpValidationFailure

void __fastcall EtwTimLogUserCetSetContextIpValidationFailure(int a1, __int64 a2, void *a3, int a4, int a5){
  __int64 *v5; 
  __int64 *v6; 
  const wchar_t *v7; 
  unsigned __int16 v9; 
  unsigned int v10; 
  int v11; 
  const wchar_t *v12; 
  wchar_t *Buffer; 
  int Length; 
  __int16 v15; 
  unsigned int v16; 
  unsigned __int16 *Pool2; 
  unsigned __int16 *v18; 
  unsigned __int16 v19; 
  __int64 v20; 
  __int64 v21; 
  __int64 v22; 
  EVENT_DESCRIPTOR *v23; 
  unsigned int v24; 
  int v25; 
  __int64 v26; 
  __int64 v27; 
  UINT64 v28; 
  UINT64 v29; 
  unsigned __int16 *v30; 
  __int16 v31[2]; 
  __int16 v32[2]; 
  __int16 v33[2]; 
  int v34; 
  int v35; 
  PVOID BaseAddress; 
  UINT64 a3a; 
  UINT64 v38; 
  __int64 v39; 
  _UNICODE_STRING P; 
  struct _EVENT_DATA_DESCRIPTOR v41; 
  int *v42; 
  __int64 v43; 
  int *v44; 
  __int64 v45; 
  __int64 v46; 
  int v47[2]; 
  int *v48; 
  __int64 v49; 
  wchar_t *v50; 
  int v51[2]; 
  UINT64 *v52; 
  __int64 v53; 
  int *v54; 
  __int64 v55; 
  __int64 v56; 
  int v57[2]; 
  int *v58; 
  __int64 v59; 
  PVOID *p_BaseAddress; 
  __int64 v61; 
  __int64 *v62; 
  __int64 v63; 
  struct _EVENT_DATA_DESCRIPTOR UserData; 
  const wchar_t *v65; 
  int v66; 
  int v67; 
  __int16 *v68; 
  __int64 v69; 
  const wchar_t *v70; 
  int v71; 
  int v72; 
  __int64 v73[20]; 
  int v74; 
  v74 = a4;
  v5 = *(__int64 **)(a2 + 1472);
  v6 = &EmptyUnicodeString;
  v35 = a1;
  a3a = 0i64;
  BaseAddress = a3;
  if( v5 )
    v6 = v5;
  v7 = L"(null)";
  P = 0i64;
  v9 = *(_WORD *)v6;
  v10 = 12;
  *(_QWORD *)&UserData.Size = 2i64;
  if( v9 )
  {
    v31[0] = v9 >> 1;
    UserData.Ptr = (unsigned __int64)v31;
    v11 = *(unsigned __int16 *)v6;
    v12 = (const wchar_t *)v6[1];
  }
  else
  {
    v31[0] = 6;
    UserData.Ptr = (unsigned __int64)v31;
    v12 = L"(null)";
    v11 = 12;
  }
  v65 = v12;
  v66 = v11;
  v67 = 0;
  EtwpQueryProcessCommandLine((_EPROCESS *)a2, &P);
  Buffer = P.Buffer;
  LOWORD(v34) = P.Length;
  v69 = 2i64;
  if( P.Length )
  {
    v70 = P.Buffer;
    v68 = v33;
    Length = P.Length;
    v15 = P.Length >> 1;
  }
  else
  {
    v70 = L"(null)";
    v68 = v33;
    Length = 12;
    v15 = 6;
  }
  v71 = Length;
  v33[0] = v15;
  v72 = 0;
  v16 = EtwpTiFillProcessIdentity(v73, a2, &a3a) + 4;
  Pool2 = (unsigned __int16 *)ExAllocatePool2(256i64, 0x200ui64, 0x6E734954ui64);
  v18 = Pool2;
  if( Pool2
    && (ZwQueryVirtualMemory((PVOID)0xFFFFFFFFFFFFFFFFi64, BaseAddress, MemorySectionName, Pool2, 0x200ui64, 0i64) >= 0 ? (v19 = *v18) : (*v18 = 0, v19 = 0),
        v19) )
  {
    v32[0] = v19 >> 1;
    v20 = 2i64 * v16;
    *(&UserData.Ptr + v20) = (unsigned __int64)v32;
    *((_QWORD *)&UserData.Size + v20) = 2i64;
    v10 = *v18;
    v7 = (const wchar_t *)*((_QWORD *)v18 + 1);
  }
  else
  {
    v32[0] = 6;
    v21 = 2i64 * v16;
    *(&UserData.Ptr + v21) = (unsigned __int64)v32;
    *((_QWORD *)&UserData.Size + v21) = 2i64;
  }
  v22 = 2i64 * (v16 + 1);
  v23 = (EVENT_DESCRIPTOR *)MITIGATION_AUDIT_USER_CET_SET_CONTEXT_IP_VALIDATION_FAILURE;
  v24 = v16 + 2;
  *(&UserData.Ptr + v22) = (unsigned __int64)v7;
  *(&UserData.Size + 2 * v22) = v10;
  *(&UserData.Reserved + 2 * v22) = 0;
  v25 = v35;
  v26 = 2i64 * v24++;
  *(&UserData.Ptr + v26) = (unsigned __int64)&v74;
  *((_QWORD *)&UserData.Size + v26) = 4i64;
  v27 = 2i64 * v24;
  v28 = v24 + 1;
  *(&UserData.Ptr + v27) = (unsigned __int64)&a5;
  v29 = EtwSecurityMitigationsRegHandle;
  *((_QWORD *)&UserData.Size + v27) = 4i64;
  if( v25 != 1 )
    v23 = (EVENT_DESCRIPTOR *)&MITIGATION_ENFORCE_USER_CET_SET_CONTEXT_IP_VALIDATION_FAILURE;
  EtwWrite(v29, v23, 0i64, v28, &UserData);
  if( (unsigned int)dword_140C02BB0 > 5 && tlgKeywordOn((__int64)&dword_140C02BB0, 0x400000000000i64) )
  {
    v35 = v25;
    v42 = &v35;
    v43 = 4i64;
    v44 = v47;
    v46 = v6[1];
    v47[0] = *(unsigned __int16 *)v6;
    v48 = v51;
    v51[0] = (unsigned __int16)v34;
    v38 = a3a;
    v52 = &v38;
    v54 = v57;
    v56 = *((_QWORD *)v30 + 1);
    v57[0] = *v30;
    v34 = v74;
    v58 = &v34;
    LODWORD(BaseAddress) = a5;
    p_BaseAddress = &BaseAddress;
    v62 = &v39;
    v45 = 2i64;
    v47[1] = 0;
    v49 = 2i64;
    v50 = Buffer;
    v51[1] = 0;
    v53 = 8i64;
    v55 = 2i64;
    v57[1] = 0;
    v59 = 4i64;
    v61 = 4i64;
    v39 = 0x1000000i64;
    v63 = 8i64;
    tlgWriteTransfer_EtwWriteTransfer(
      (__int64)&dword_140C02BB0,
      (unsigned __int8 *)byte_14002C565,
      0i64,
      0i64,
      0xDu,
      &v41);
  }
  if( Buffer )
    ExFreePoolWithTag(Buffer, 0);
  if( v18 )
    ExFreePoolWithTag(v18, 0);
}

Referenced by: