EtwTimLogProhibitNonMicrosoftBinaries

VOID __fastcall EtwTimLogProhibitNonMicrosoftBinaries(INT64 a1, INT64 a2, CHAR r8_0, CHAR a4, UINT16 *a5){
  __int64 *v5; 
  __int64 *v6; 
  const wchar_t *v7; 
  int v8; 
  unsigned __int16 v10; 
  int v11; 
  const wchar_t *v12; 
  int v13; 
  __int16 v14; 
  int v15; 
  int v16; 
  UINT16 *v17; 
  int v18; 
  unsigned int v19; 
  __int64 v20; 
  unsigned int v21; 
  unsigned int v22; 
  __int64 v23; 
  unsigned int v24; 
  unsigned int v25; 
  __int16 v26; 
  __int64 v27; 
  __int64 v28; 
  UINT64 v29; 
  EVENT_DESCRIPTOR *v30; 
  PVOID v31; 
  CHAR v32; 
  CHAR v33; 
  __int16 v34[2]; 
  __int16 v35; 
  __int16 v36; 
  int v37; 
  UINT64 a3; 
  PVOID P[2]; 
  UINT64 v40; 
  struct _EVENT_DATA_DESCRIPTOR v41; 
  int *v42; 
  __int64 v43; 
  int *v44; 
  __int64 v45; 
  __int64 v46; 
  int v47[2]; 
  int *v48; 
  __int64 v49; 
  PVOID v50; 
  int v51[2]; 
  UINT64 *v52; 
  __int64 v53; 
  int *v54; 
  __int64 v55; 
  __int64 v56; 
  int v57[2]; 
  CHAR *v58; 
  __int64 v59; 
  CHAR *v60; 
  __int64 v61; 
  EVENT_DATA_DESCRIPTOR UserData; 
  const wchar_t *v63; 
  int v64; 
  int v65; 
  __int16 *v66; 
  __int64 v67; 
  const wchar_t *v68; 
  int v69; 
  int v70; 
  __int64 v71[24]; 
  CHAR v72; 
  CHAR v73; 
  v73 = a4;
  v72 = r8_0;
  v5 = *(__int64 **)(a2 + 1472);
  v6 = &EmptyUnicodeString;
  v7 = L"(null)";
  a3 = 0i64;
  v8 = a1;
  if( v5 )
    v6 = v5;
  *(_OWORD *)P = 0i64;
  v10 = *(_WORD *)v6;
  *(_QWORD *)&UserData.Size = 2i64;
  if( v10 )
  {
    v34[0] = v10 >> 1;
    UserData.Ptr = (unsigned __int64)v34;
    v11 = *(unsigned __int16 *)v6;
    v12 = (const wchar_t *)v6[1];
  }
  else
  {
    v34[0] = 6;
    UserData.Ptr = (unsigned __int64)v34;
    v12 = L"(null)";
    v11 = 12;
  }
  v63 = v12;
  v64 = v11;
  v65 = 0;
  EtwpQueryProcessCommandLine((_EPROCESS *)a2, (_UNICODE_STRING *)P);
  v67 = 2i64;
  v66 = &v35;
  if( LOWORD(P[0]) )
  {
    v68 = (const wchar_t *)P[1];
    v13 = LOWORD(P[0]);
    v14 = LOWORD(P[0]) >> 1;
  }
  else
  {
    v13 = 12;
    v68 = L"(null)";
    v14 = 6;
  }
  v35 = v14;
  v69 = v13;
  v70 = 0;
  v15 = EtwpTiFillProcessIdentity(v71, a2, &a3);
  v16 = EtwpTiFillThreadIdentity((INT64)(&UserData + (unsigned int)(v15 + 4)), (INT64)KeGetCurrentThread());
  v17 = a5;
  v19 = v16 + v18;
  v20 = 2i64 * v19;
  v21 = v19 + 1;
  *(&UserData.Ptr + v20) = (unsigned __int64)&v72;
  *((_QWORD *)&UserData.Size + v20) = 1i64;
  v22 = v21 + 1;
  v23 = 2i64 * v21;
  *(&UserData.Ptr + v23) = (unsigned __int64)&v73;
  *((_QWORD *)&UserData.Size + v23) = 1i64;
  if( v17 && *v17 )
  {
    v7 = (const wchar_t *)*((_QWORD *)v17 + 1);
    v24 = v21 + 2;
    v25 = *v17;
    v26 = *v17 >> 1;
  }
  else
  {
    v25 = 12;
    v24 = v21 + 2;
    v26 = 6;
  }
  v36 = v26;
  v27 = 2i64 * v22;
  v28 = 2i64 * v24;
  v29 = v24 + 1;
  *(&UserData.Ptr + v27) = (unsigned __int64)&v36;
  *((_QWORD *)&UserData.Size + v27) = 2i64;
  *(&UserData.Ptr + v28) = (unsigned __int64)v7;
  *(&UserData.Size + 2 * v28) = v25;
  v30 = (EVENT_DESCRIPTOR *)MITIGATION_AUDIT_PROHIBIT_NON_MICROSOFT_BINARIES;
  if( v8 != 1 )
    v30 = (EVENT_DESCRIPTOR *)&MITIGATION_ENFORCE_PROHIBIT_NON_MICROSOFT_BINARIES;
  *(&UserData.Reserved + 2 * v28) = 0;
  EtwWrite(EtwSecurityMitigationsRegHandle, v30, 0i64, v29, &UserData);
  v31 = P[1];
  if( (unsigned int)dword_140C02BB0 > 5 && tlgKeywordOn((__int64)&dword_140C02BB0, 0x400000000000i64) )
  {
    v37 = v8;
    v42 = &v37;
    v43 = 4i64;
    v44 = v47;
    v46 = v6[1];
    v47[0] = *(unsigned __int16 *)v6;
    v48 = v51;
    v51[0] = LOWORD(P[0]);
    v40 = a3;
    v52 = &v40;
    v54 = v57;
    v56 = *((_QWORD *)v17 + 1);
    v57[0] = *v17;
    v32 = v72;
    v58 = &v32;
    v33 = v73;
    v60 = &v33;
    v45 = 2i64;
    v47[1] = 0;
    v49 = 2i64;
    v50 = v31;
    v51[1] = 0;
    v53 = 8i64;
    v55 = 2i64;
    v57[1] = 0;
    v59 = 1i64;
    v61 = 1i64;
    tlgWriteTransfer_EtwWriteTransfer(
      (__int64)&dword_140C02BB0,
      (unsigned __int8 *)word_14002C402,
      0i64,
      0i64,
      0xCu,
      &v41);
  }
  if( v31 )
    ExFreePoolWithTag(v31, 0);
}

Referenced by: