EtwTiLogReadWriteVm

CHAR __fastcall EtwTiLogReadWriteVm(INT64 a1, INT64 a2, INT64 a3, INT64 a4, CHAR a5, CHAR a6){
  _ETHREAD *CurrentThread; 
  int v7; 
  UINT64 v10; 
  UINT64 v11; 
  EVENT_DESCRIPTOR *v12; 
  __int64 *v13; 
  __int64 *v14; 
  int v15; 
  int v16; 
  int v17; 
  int v18; 
  int v19; 
  unsigned int v20; 
  __int64 v21; 
  __int64 v22; 
  UINT64 v23; 
  UINT64 a3a; 
  UINT64 v26; 
  EVENT_DATA_DESCRIPTOR UserData; 
  __int64 v28[32]; 
  int v29; 
  v29 = a1;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v7 = a4;
  if( *((_BYTE *)CurrentThread + 562) == 1 )
  {
    v10 = EtwThreatIntProvRegHandle;
    v11 = 196608i64;
    if( (_DWORD)a4 != 16 )
      v11 = 786432i64;
    LOBYTE(CurrentThread) = EtwProviderEnabled(EtwThreatIntProvRegHandle, 0, v11);
    if( (_BYTE)CurrentThread )
    {
      if( a2 == a3 )
      {
        v14 = THREATINT_READVM_LOCAL;
        v13 = THREATINT_WRITEVM_LOCAL;
      }
      else
      {
        v13 = (__int64 *)&THREATINT_WRITEVM_REMOTE;
        v14 = THREATINT_READVM_REMOTE;
      }
      if( v7 != 16 )
        v14 = v13;
      LOBYTE(CurrentThread) = EtwEventEnabled(v10, (EVENT_DESCRIPTOR *)v14, v12);
      if( (_BYTE)CurrentThread )
      {
        UserData.Reserved = 0;
        UserData.Ptr = (unsigned __int64)&v29;
        UserData.Size = 4;
        v15 = EtwpTiFillProcessIdentity(v28, a2, &a3a);
        v16 = EtwpTiFillThreadIdentity((INT64)(&UserData + (unsigned int)(v15 + 1)), (INT64)KeGetCurrentThread());
        v18 = EtwpTiFillProcessIdentity(&UserData.Ptr + 2 * (unsigned int)(v16 + v17), a3, &v26);
        v20 = v18 + v19;
        v21 = 2i64 * v20++;
        *(&UserData.Reserved + 2 * v21) = 0;
        *(&UserData.Ptr + v21) = (unsigned __int64)&a5;
        *(&UserData.Size + 2 * v21) = 8;
        v22 = 2i64 * v20;
        *(&UserData.Reserved + 2 * v22) = 0;
        *(&UserData.Ptr + v22) = (unsigned __int64)&a6;
        v23 = EtwThreatIntProvRegHandle;
        *(&UserData.Size + 2 * v22) = 8;
        LOBYTE(CurrentThread) = EtwWrite(v23, (EVENT_DESCRIPTOR *)v14, 0i64, v20 + 1, &UserData);
      }
    }
  }
  return(char)CurrentThread;
}

Referenced by: