KsepEvntLogShimsApplied

void __fastcall KsepEvntLogShimsApplied(__int64 a1, __int64 a2, EVENT_DESCRIPTOR *a3){
  unsigned int v3; 
  __int64 v5; 
  unsigned __int16 v7; 
  UNICODE_STRING *v8; 
  UNICODE_STRING *v9; 
  wchar_t *p_Length; 
  _UNICODE_STRING *v11; 
  unsigned __int16 *v12; 
  wchar_t *v13; 
  wchar_t *Buffer; 
  int v15; 
  unsigned int v16; 
  unsigned int v17; 
  UINT64 UserDataCount; 
  unsigned int v19; 
  struct _UNICODE_STRING Destination; 
  unsigned __int16 *v21; 
  EVENT_DATA_DESCRIPTOR UserData; 
  __int64 v23; 
  __int64 v24; 
  unsigned int *v25; 
  __int64 v26; 
  wchar_t *v27; 
  int v28; 
  int v29; 
  v3 = 0;
  v21 = (unsigned __int16 *)a1;
  v5 = (unsigned int)a3;
  v19 = (unsigned int)a3;
  v7 = 0;
  Destination = 0i64;
  if( *(_QWORD *)KseEtwHandle
    && EtwEventEnabled(*(UINT64 *)KseEtwHandle, (EVENT_DESCRIPTOR *)&KseShimsApplied, a3)
    && (_DWORD)v5
    && a2
    && a1 )
  {
    KsepPoolAllocatePaged(94 * v5);
    v9 = v8;
    if( v8 )
    {
      p_Length = &v8[v19].Length;
      if( v19 )
      {
        do
        {
          v11 = &v9[v3];
          *v11 = 0i64;
          v11->Buffer = p_Length;
          p_Length += 39;
          v11->MaximumLength = 78;
          RtlStringFromGUIDEx((const _GUID *const)(a2 + 80i64 * v3++), v11, 0);
          v7 += v11->Length + 4;
        }
        while( v3 < v19 );
        v12 = v21;
        if( v7 )
        {
          KsepPoolAllocatePaged(v7);
          Destination.Buffer = v13;
          Buffer = v13;
          if( v13 )
          {
            v15 = 0;
            Destination.MaximumLength = v7;
            if( v19 )
            {
              while( RtlAppendUnicodeStringToString(&Destination, &v9[v15]) >= 0 )
              {
                v16 = v19;
                if( v15 != v19 - 1 )
                {
                  if( RtlAppendUnicodeToString(&Destination, (PWCHAR)L"\n") < 0 )
                    break;
                  v16 = v19;
                }
                if( ++v15 >= v16 )
                {
                  Buffer = Destination.Buffer;
                  goto LABEL_18;
                }
              }
            }
            else
            {
LABEL_18:
              UserData.Ptr = *((_QWORD *)v12 + 1);
              v17 = *v12 + 2;
              v24 = 4i64;
              UserData.Size = v17;
              v23 = a2 + 68;
              v25 = &v19;
              v26 = 4i64;
              v28 = Destination.Length + 2;
              LODWORD(UserDataCount) = 4;
              v27 = Buffer;
              UserData.Reserved = 0;
              v29 = 0;
              EtwWriteEx(
                *(UINT64 *)KseEtwHandle,
                (EVENT_DESCRIPTOR *)&KseShimsApplied,
                0i64,
                0i64,
                0i64,
                0i64,
                UserDataCount,
                &UserData);
            }
          }
        }
      }
      ExFreePoolWithTag(v9, 0x6145534Bu);
      _InterlockedIncrement(&dword_140C2A7E4);
    }
    if( Destination.Buffer )
    {
      ExFreePoolWithTag(Destination.Buffer, 0x6145534Bu);
      _InterlockedIncrement(&dword_140C2A7E4);
    }
  }
}

Referenced by: