EtwTimLogProhibitDynamicCode

VOID __fastcall EtwTimLogProhibitDynamicCode(INT64 a1, INT64 a2){
  const EVENT_DESCRIPTOR *v3; 
  if( (*(_DWORD *)(a2 + 2512) & 0x800) != 0 )
  {
    v3 = (const EVENT_DESCRIPTOR *)MITIGATION_AUDIT_PROHIBIT_DYNAMIC_CODE;
    if( (_DWORD)a1 != 1 )
      v3 = &MITIGATION_ENFORCE_PROHIBIT_DYNAMIC_CODE;
    EtwpTimLogMitigationForProcess(0i64, (unsigned int)a1, v3, a2);
    _InterlockedAnd((volatile signed __int32 *)(a2 + 2512), 0xFFFFF7FF);
  }
}

Referenced by:

MiArbitraryCodeBlocked