PsIsProcessLoggingEnabled

BOOL __fastcall PsIsProcessLoggingEnabled(INT64 a1, INT64 a2){
  BOOL result; 
  int v3; 
  _DWORD *v4; 
  result = 0;
  v3 = 0;
  v4 = 0i64;
  if( (_DWORD)a2 == 16 )
  {
    v3 = 0x1000000;
    v4 = (_DWORD *)(a1 + 1120);
LABEL_3:
    LOBYTE(result) = (v3 & *v4) != 0;
    return result;
  }
  if( (_DWORD)a2 != 32 )
  {
    if( (_DWORD)a2 == 2 )
    {
      v3 = 0x100000;
      v4 = (_DWORD *)(a1 + 2172);
    }
    else if( (_DWORD)a2 == 2048 )
    {
      v3 = 0x80000;
      v4 = (_DWORD *)(a1 + 2172);
    }
    goto LABEL_3;
  }
  LOBYTE(result) = (*(_DWORD *)(a1 + 1120) & 0x2000000) != 0;
  return result;
}

Referenced by:

MiReadWriteVirtualMemory