EtwTimLogProhibitWin32kSystemCalls

VOID __fastcall EtwTimLogProhibitWin32kSystemCalls(INT64 a1, INT64 a2){
  const EVENT_DESCRIPTOR *v3; 
  if( (*(_DWORD *)(a2 + 2512) & 0x2000) != 0 )
  {
    v3 = (const EVENT_DESCRIPTOR *)MITIGATION_AUDIT_PROHIBIT_WIN32K_SYSTEM_CALLS;
    if( (_DWORD)a1 != 1 )
      v3 = &MITIGATION_ENFORCE_PROHIBIT_WIN32K_SYSTEM_CALLS;
    EtwpTimLogMitigationForProcess(2i64, (unsigned int)a1, v3, a2);
    _InterlockedAnd((volatile signed __int32 *)(a2 + 2512), 0xFFFFDFFF);
  }
}

Referenced by: