EtwTiLogAllocExecVm

UINT8 EtwTiLogAllocExecVm(INT64 a1, CHAR a2, ...){
  UINT8 result; 
  EVENT_DESCRIPTOR *v5; 
  __int64 v6; 
  INT64 v7; 
  INT64 v8; 
  EVENT_DESCRIPTOR *v9; 
  int v10; 
  int v11; 
  int v12; 
  int v13; 
  int v14; 
  int v15; 
  int v16; 
  unsigned int v17; 
  __int64 v18; 
  __int64 v19; 
  __int64 v20; 
  __int64 v21; 
  UINT64 v22; 
  UINT64 a3; 
  UINT64 v24; 
  UINT64 v25; 
  _EVENT_DATA_DESCRIPTOR UserData[24]; 
  __int64 v27; 
  __int64 v28; 
  __int64 v29; 
  va_list va3; 
  va_list va; 
  va_list va1; 
  va_list va2; 
  va_start(va3, a2);
  va_start(va2, a2);
  va_start(va1, a2);
  va_start(va, a2);
  v27 = va_arg(va1, _QWORD);
  va_copy(va2, va1);
  v28 = va_arg(va2, _QWORD);
  va_copy(va3, va2);
  v29 = va_arg(va3, _QWORD);
  result = EtwProviderEnabled(EtwThreatIntProvRegHandle, 0, 0xFui64);
  if( result )
  {
    v6 = 0i64;
    v7 = *((_QWORD *)KeGetCurrentThread() + 23);
    v8 = *((_QWORD *)KeGetCurrentThread() + 68);
    if( v8 == a1 )
      v6 = 8i64;
    v9 = *(EVENT_DESCRIPTOR **)((char *)off_140006620 + (a2 != 0 ? 0 : 0x10) + v6);
    result = EtwEventEnabled(EtwThreatIntProvRegHandle, v9, v5);
    if( result )
    {
      v10 = EtwpTiFillProcessIdentity((_QWORD *)UserData, v7, &a3);
      v11 = EtwpTiFillThreadIdentity((INT64)&UserData[v10], (INT64)KeGetCurrentThread());
      v13 = EtwpTiFillProcessIdentity(&UserData[v11 + v12].Ptr, a1, &v24);
      v15 = EtwpTiFillProcessIdentity(&UserData[v13 + v14].Ptr, v8, &v25);
      v17 = v15 + v16;
      v18 = v17;
      UserData[v18].Reserved = 0;
      UserData[v18].Ptr = (unsigned __int64)va;
      UserData[v18].Size = 8;
      v19 = v17 + 1;
      UserData[v19].Reserved = 0;
      UserData[v19].Ptr = (unsigned __int64)va1;
      UserData[v19].Size = 8;
      v20 = v17 + 2;
      v17 += 3;
      v20 *= 2i64;
      *(&UserData[0].Reserved + 2 * v20) = 0;
      *(&UserData[0].Ptr + v20) = (unsigned __int64)va2;
      *(&UserData[0].Size + 2 * v20) = 4;
      v21 = v17;
      UserData[v21].Reserved = 0;
      UserData[v21].Ptr = (unsigned __int64)va3;
      v22 = EtwThreatIntProvRegHandle;
      UserData[v21].Size = 4;
      return EtwWrite(v22, v9, 0i64, v17 + 1, UserData);
    }
  }
  return result;
}

Referenced by: