EtwpTiFillProcessIdentity

INT64 __fastcall EtwpTiFillProcessIdentity(_QWORD *a1, INT64 a2, UINT64 *a3){
  INT64 result; 
  a1[1] = 4i64;
  *a1 = a2 + 1088;
  a1[2] = a2 + 1128;
  a1[3] = 8i64;
  *a3 = *(_QWORD *)(a2 + 2296) | ((unsigned __int64)KUSER_SHARED_DATA.BootId << 48);
  a1[6] = a2 + 2168;
  a1[8] = a2 + 2169;
  a1[10] = a2 + 2170;
  result = 6i64;
  a1[4] = a3;
  a1[5] = 8i64;
  a1[7] = 1i64;
  a1[9] = 1i64;
  a1[11] = 1i64;
  return result;
}

Referenced by: