EtwTiLogDriverObjectLoad

BOOLEAN __fastcall EtwTiLogDriverObjectLoad(unsigned __int16 *a1){
  UINT64 v1; 
  BOOLEAN result; 
  const wchar_t *v4; 
  int v5; 
  __int16 v6; 
  int v7; 
  int v8; 
  int v9; 
  __int16 v10; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  const wchar_t *v12; 
  int v13; 
  int v14; 
  int *v15; 
  __int64 v16; 

  v1 = *(&ExBootDevicesRemovedEvent + 179);
  v9 = 0;
  result = EtwEventEnabled(*(&ExBootDevicesRemovedEvent + 179), &THREATINT_DRIVER_OBJECT_LOAD);
  if( result )
  {
    result = EtwProviderEnabled(v1, 0, 0x40000000ui64);
    if( result )
    {
      if( a1 && *a1 )
      {
        v4 = (const wchar_t *)*((_QWORD *)a1 + 1);
        v5 = *a1;
        v6 = *a1 >> 1;
      }
      else
      {
        v5 = 12;
        v4 = L"(null)";
        v6 = 6;
      }
      v10 = v6;
      v13 = v5;
      UserData.Ptr = (unsigned __int64)&v10;
      *(_QWORD *)&UserData.Size = 2i64;
      v12 = v4;
      v14 = 0;
      EtwpTiQueryCodeIntegrityOptions(&v9);
      v7 = v9;
      v16 = 4i64;
      if( v8 < 0 )
        v7 = -1;
      v15 = &v9;
      v9 = v7;
      return EtwWrite(*(&ExBootDevicesRemovedEvent + 179), &THREATINT_DRIVER_OBJECT_LOAD, 0, 3u, &UserData);
    }
  }
  return result;
}

Referenced by: