PsIsProcessLoggingEnabled
BOOL __fastcall PsIsProcessLoggingEnabled(INT64 a1, INT64 a2){
BOOL result;
int v3;
_DWORD *v4;
result = 0;
v3 = 0;
v4 = 0i64;
if( (_DWORD)a2 == 16 )
{
v3 = 0x1000000;
v4 = (_DWORD *)(a1 + 1120);
LABEL_3:
LOBYTE(result) = (v3 & *v4) != 0;
return result;
}
if( (_DWORD)a2 != 32 )
{
if( (_DWORD)a2 == 2 )
{
v3 = 0x100000;
v4 = (_DWORD *)(a1 + 2172);
}
else if( (_DWORD)a2 == 2048 )
{
v3 = 0x80000;
v4 = (_DWORD *)(a1 + 2172);
}
goto LABEL_3;
}
LOBYTE(result) = (*(_DWORD *)(a1 + 1120) & 0x2000000) != 0;
return result;
}Referenced by:
MiReadWriteVirtualMemory