MiLogHotPatchOperationStatus
VOID __stdcall MiLogHotPatchOperationStatus(
INT64 a1,
INT64 a2,
PFN_WDFCX_DEVICE_POST_SELF_MANAGED_IO_INIT *a3,
INT64 a4,
INT64 a5){
int v5;
_UNICODE_STRING *p_DestinationString;
int v7;
int v8;
__int64 v9;
_EPROCESS *v10;
__int64 v11;
__int64 v12;
ULONG v13;
__int64 v14;
unsigned __int8 *v15;
__int64 *v16;
int v17;
int v18;
unsigned int ProcessId;
int v20;
int v21;
int v22;
int v23;
int v24;
int v25;
int v26;
int v27;
int v28;
INT8 *ImageFileName;
UINT64 Key;
__int64 v31;
__int64 v32;
__int64 v33;
_UNICODE_STRING DestinationString;
__int64 v35[13];
int v36[2];
__int64 *v37;
__int64 v38;
char v39;
int *v40;
__int64 v41;
int *v42;
__int64 v43;
int *v44;
__int64 v45;
int *v46;
__int64 v47;
wchar_t *Buffer;
int v49[2];
__int64 *v50;
__int64 v51;
char v52[32];
unsigned int *p_ProcessId;
__int64 v54;
INT64 v55[11];
int v56[2];
__int64 *v57;
__int64 v58;
v5 = a4;
p_DestinationString = (_UNICODE_STRING *)a3;
ImageFileName = 0i64;
v7 = a2;
v8 = a1;
DestinationString = 0i64;
if( *(&stru_140C4DB30 + 542) )
{
if( !a3 )
{
RtlInitUnicodeString(&DestinationString, 0i64);
p_DestinationString = &DestinationString;
}
if( (_DWORD)a5 )
{
if( (_DWORD)a5 == 1 )
{
if( **(&stru_140C4DB30 + 542) <= 5u || !tlgKeywordOn(*(&stru_140C4DB30 + 542), 0x400000000020i64) )
return;
v23 = v5;
v35[4] = (__int64)&v23;
v15 = (unsigned __int8 *)&unk_140025520;
v35[5] = 4i64;
v35[6] = (__int64)&v24;
v35[8] = (__int64)&v25;
v35[10] = (__int64)v36;
v35[12] = (__int64)p_DestinationString->Buffer;
v36[0] = p_DestinationString->Length;
v32 = 2164260864i64;
v37 = &v32;
v16 = v35;
v24 = v8;
v35[7] = 4i64;
v25 = v7;
v35[9] = 4i64;
v35[11] = 2i64;
v36[1] = 0;
v38 = 8i64;
}
else
{
if( **(&stru_140C4DB30 + 542) <= 5u || !tlgKeywordOn(*(&stru_140C4DB30 + 542), 0x400000000020i64) )
return;
v26 = v5;
v40 = &v26;
v15 = (unsigned __int8 *)&byte_140025593;
v41 = 4i64;
v42 = &v27;
v44 = &v28;
v46 = v49;
Buffer = p_DestinationString->Buffer;
v49[0] = p_DestinationString->Length;
v33 = 2164260864i64;
v50 = &v33;
v16 = (__int64 *)&v39;
v27 = v8;
v43 = 4i64;
v28 = v7;
v45 = 4i64;
v47 = 2i64;
v49[1] = 0;
v51 = 8i64;
}
tlgWriteEx_EtwWriteEx(v14, v15, v12, v13, v17, v18, 8u, (__int64)v16);
return;
}
MiFillLogProcessInfo(&KeGetCurrentThread()->ApcState.Process->Vm.Instance, &Key, &ImageFileName);
v9 = *(&stru_140C4DB30 + 542);
if( **(&stru_140C4DB30 + 542) > 5u )
{
if( tlgKeywordOn(*(&stru_140C4DB30 + 542), 0x400000000020i64) )
{
ProcessId = (unsigned int)PsGetProcessId(v10);
p_ProcessId = &ProcessId;
v54 = 4i64;
tlgCreate1Sz_char((INT64)v55, ImageFileName);
v20 = v5;
v55[2] = (INT64)&v20;
v55[3] = 4i64;
v55[4] = (INT64)&v21;
v21 = v8;
v55[6] = (INT64)&v22;
v55[5] = 4i64;
v55[8] = (INT64)v56;
v55[10] = (INT64)p_DestinationString->Buffer;
v56[0] = p_DestinationString->Length;
v31 = 2164260864i64;
v57 = &v31;
v22 = v7;
v55[7] = 4i64;
v55[9] = 2i64;
v56[1] = 0;
v58 = 8i64;
tlgWriteEx_EtwWriteEx(v9, (unsigned __int8 *)byte_140025495, v11, 1u, v17, v18, 0xAu, (__int64)v52);
}
}
}
}Referenced by:
MiApplyHotPatchToDriver
MiHotPatchImage
MiLoadHotPatch
MiUnloadHotPatch
MmRegisterHotPatch