CmpTraceSecurityChanging

INT64 __fastcall CmpTraceSecurityChanging(INT64 rcx0, VOID *a2, INT64 a3, VOID *a4, VOID *a1){
  int v7; 
  NTSTATUS v8; 
  _UNICODE_STRING *v9; 
  unsigned int v10; 
  unsigned int v12; 
  unsigned int v13; 
  unsigned __int16 v14; 
  __int64 v15; 
  int Length; 
  _UNICODE_STRING *KeyPath[2]; 
  struct _EVENT_DATA_DESCRIPTOR v18; 
  int *v19; 
  __int64 v20; 
  wchar_t *Buffer; 
  int v22[2]; 
  int *v23; 
  __int64 v24; 
  VOID *v25; 
  int v26[2]; 
  _UNICODE_STRING **v27; 
  __int64 v28; 
  int *v29; 
  __int64 v30; 
  VOID *v31; 
  int v32[2]; 
  int *v33; 
  __int64 v34; 
  VOID *v35; 
  int v36[2]; 
  KeyPath[0] = 0i64;
  v7 = a3;
  v8 = CmpConstructNameWithStatus((_CM_KEY_CONTROL_BLOCK *)rcx0, KeyPath);
  v9 = KeyPath[0];
  v10 = v8;
  if( v8 >= 0 )
  {
    if( RtlFindUnicodeSubstring(&KeyPath[0]->Length, &CmMpsSvcKeySubstring, 1) )
    {
      v12 = RtlLengthSecurityDescriptorStrict(a2);
      if( v12 > 0xFFFF )
        LOWORD(v12) = -1;
      v13 = RtlLengthSecurityDescriptorStrict(a4);
      if( v13 > 0xFFFF )
        LOWORD(v13) = -1;
      RtlLengthSecurityDescriptorStrict(a1);
      if( (unsigned int)dword_140C02130 > 5 && tlgKeywordOn((__int64)&dword_140C02130, 2i64) )
      {
        Length = v9->Length;
        Buffer = v9->Buffer;
        v23 = v26;
        v19 = v22;
        v26[0] = (unsigned __int16)v12;
        v27 = KeyPath;
        v29 = v32;
        v32[0] = (unsigned __int16)v13;
        v33 = v36;
        v36[0] = v14;
        v22[0] = Length;
        v22[1] = 0;
        v26[1] = 0;
        v32[1] = 0;
        v36[1] = 0;
        v20 = v15;
        v24 = v15;
        v25 = a2;
        LODWORD(KeyPath[0]) = v7;
        v28 = 4i64;
        v30 = v15;
        v31 = a4;
        v34 = v15;
        v35 = a1;
        tlgWriteTransfer_EtwWriteTransfer(
          (__int64)&dword_140C02130,
          (unsigned __int8 *)&word_1400222E6,
          0i64,
          0i64,
          0xBu,
          &v18);
      }
    }
    v10 = 0;
  }
  if( v9 )
    CmpFreeTransientPoolWithTag(v9, 0x624E4D43ui64);
  return v10;
}

Referenced by: