EtwTraceAdminlessAccessFailure

CHAR __fastcall EtwTraceAdminlessAccessFailure(INT64 a1, INT64 a2, INT64 a3, CHAR a4){
  int v4; 
  __int64 v5; 
  unsigned __int16 *v6; 
  int v7; 
  unsigned __int16 *v8; 
  int v9; 
  __int16 *v10; 
  char *v11; 
  unsigned __int16 *v12; 
  int v13; 
  int v15; 
  int v16; 
  int v17; 
  int v18; 
  int v19; 
  int v20; 
  __int64 v21; 
  _LARGE_INTEGER CurrentTime; 
  __int64 v23; 
  const wchar_t *v24; 
  EVENT_DATA_DESCRIPTOR UserData; 
  int *v26; 
  __int64 v27; 
  struct _EVENT_DATA_DESCRIPTOR v28; 
  int *v29; 
  __int64 v30; 
  int *v31; 
  __int64 v32; 
  __int64 v33; 
  int v34[2]; 
  int *v35; 
  __int64 v36; 
  int *v37; 
  __int64 v38; 
  char v39; 
  int *v40; 
  __int64 v41; 
  int *v42; 
  __int64 v43; 
  __int64 v44; 
  int v45[2]; 
  int *v46; 
  __int64 v47; 
  char v48; 
  int *v49; 
  __int64 v50; 
  int *v51; 
  __int64 v52; 
  __int64 v53; 
  int v54[2]; 
  __int64 *v55; 
  __int64 v56; 
  int v57; 
  v57 = a1;
  CurrentTime.QuadPart = 0i64;
  v24 = &word_1407CF120;
  v4 = a3;
  v23 = 0x20000i64;
  v5 = *(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1472i64);
  if( !(_DWORD)a3 )
  {
    if( a4 )
    {
      if( (unsigned int)dword_140C02BB0 <= 5 )
        goto LABEL_13;
      LOBYTE(v5) = tlgKeywordOn((__int64)&dword_140C02BB0, 0x400000000000i64);
      if( !(_BYTE)v5 )
        goto LABEL_13;
      v20 = v13;
      v49 = &v20;
      v10 = word_14002C9DA;
      v50 = 4i64;
      v51 = v54;
      v53 = *((_QWORD *)v12 + 1);
      v54[0] = *v12;
      LODWORD(v21) = v57;
      v55 = &v21;
      v11 = &v48;
      v52 = 2i64;
      v54[1] = 0;
      v56 = 4i64;
    }
    else
    {
      if( (unsigned int)dword_140C02BB0 <= 5 )
        goto LABEL_13;
      LOBYTE(v5) = tlgKeywordOn((__int64)&dword_140C02BB0, 0x400000000000i64);
      if( !(_BYTE)v5 )
        goto LABEL_13;
      v18 = v9;
      v40 = &v18;
      v10 = word_14002CA22;
      v41 = 4i64;
      v42 = v45;
      v44 = *((_QWORD *)v8 + 1);
      v45[0] = *v8;
      v19 = v57;
      v46 = &v19;
      v11 = &v39;
      v43 = 2i64;
      v45[1] = 0;
      v47 = 4i64;
    }
    LOBYTE(v5) = tlgWriteTransfer_EtwWriteTransfer(
                   (__int64)&dword_140C02BB0,
                   (unsigned __int8 *)v10,
                   0i64,
                   0i64,
                   6u,
                   (PEVENT_DATA_DESCRIPTOR)v11);
    goto LABEL_13;
  }
  if( (unsigned int)dword_140C02BB0 > 5 )
  {
    LOBYTE(v5) = tlgKeywordOn((__int64)&dword_140C02BB0, 0x400000000000i64);
    if( (_BYTE)v5 )
    {
      v15 = v7;
      v29 = &v15;
      v30 = 4i64;
      v31 = v34;
      v33 = *((_QWORD *)v6 + 1);
      v34[0] = *v6;
      v16 = v57;
      v35 = &v16;
      v37 = &v17;
      v32 = 2i64;
      v34[1] = 0;
      v36 = 4i64;
      v17 = v4;
      v38 = 4i64;
      LOBYTE(v5) = tlgWriteTransfer_EtwWriteTransfer(
                     (__int64)&dword_140C02BB0,
                     (unsigned __int8 *)&word_14002C96E,
                     0i64,
                     0i64,
                     7u,
                     &v28);
    }
  }
LABEL_13:
  if( EtwAdminlessProvRegHandle && SeAdminlessEnableEventLogging )
  {
    KeQuerySystemTimePrecise(&CurrentTime);
    UserData.Ptr = (unsigned __int64)&CurrentTime;
    *(_QWORD *)&UserData.Size = 8i64;
    v26 = &v57;
    v27 = 4i64;
    LOBYTE(v5) = EtwWrite(EtwAdminlessProvRegHandle, (EVENT_DESCRIPTOR *)&LpacAccessFailureLog, 0i64, 2ui64, &UserData);
  }
  return v5;
}

Referenced by: