EtwpTimLogMitigationForProcess

unsigned __int8 __fastcall EtwpTimLogMitigationForProcess(int a1, int a2, const _EVENT_DESCRIPTOR *a3, _EPROCESS *a4){
  _OBJECT_NAME_INFORMATION *ImageFileName; 
  __int64 *v5; 
  const wchar_t *v10; 
  int Length; 
  unsigned __int16 v12; 
  int v13; 
  wchar_t *Buffer; 
  __int16 v15; 
  int v16; 
  NTSTATUS v17; 
  int v18; 
  unsigned __int8 result; 
  wchar_t *v20; 
  __int16 v21[2]; 
  __int16 v22; 
  int v23; 
  int v24; 
  __int64 v25; 
  _UNICODE_STRING CommandLine; 
  __int64 v27; 
  _EVENT_DATA_DESCRIPTOR v28; 
  int *v29; 
  __int64 v30; 
  int *v31; 
  __int64 v32; 
  int *v33; 
  __int64 v34; 
  __int64 v35; 
  int v36[2]; 
  int *v37; 
  __int64 v38; 
  wchar_t *v39; 
  int v40[2]; 
  __int64 *v41; 
  __int64 v42; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  const wchar_t *v44; 
  int v45; 
  int v46; 
  __int16 *v47; 
  __int64 v48; 
  wchar_t *v49; 
  int v50; 
  int v51; 
  __int64 v52[16]; 

  ImageFileName = a4->SeAuditProcessCreationInfo.ImageFileName;
  v5 = &EmptyUnicodeString;
  v25 = 0i64;
  if( ImageFileName )
    v5 = (__int64 *)ImageFileName;
  v10 = L"(null)";
  CommandLine = 0i64;
  Length = 12;
  v12 = *(_WORD *)v5;
  *(_QWORD *)&UserData.Size = 2i64;
  if( v12 )
  {
    v21[0] = v12 >> 1;
    UserData.Ptr = (unsigned __int64)v21;
    v13 = *(unsigned __int16 *)v5;
    v10 = (const wchar_t *)v5[1];
  }
  else
  {
    v21[0] = 6;
    UserData.Ptr = (unsigned __int64)v21;
    v13 = 12;
  }
  v44 = v10;
  v46 = 0;
  v45 = v13;
  EtwpQueryProcessCommandLine(a4, &CommandLine);
  v48 = 2i64;
  v47 = &v22;
  if( CommandLine.Length )
  {
    Buffer = CommandLine.Buffer;
    Length = CommandLine.Length;
    v15 = CommandLine.Length >> 1;
  }
  else
  {
    Buffer = L"(null)";
    v15 = 6;
  }
  v22 = v15;
  v51 = 0;
  v49 = Buffer;
  v50 = Length;
  v16 = EtwpTiFillProcessIdentity(v52, (__int64)a4, (unsigned __int64 *)&v25);
  v17 = EtwpTiFillThreadIdentity((INT64)(&UserData + (unsigned int)(v16 + 4)), (INT64)KeGetCurrentThread());
  result = EtwWrite(*(&ExBootDevicesRemovedEvent + 248), a3, 0, v17 + v18, &UserData);
  v20 = CommandLine.Buffer;
  if( *(&stru_140C00F40 + 1820) > 5u )
  {
    result = tlgKeywordOn((__int64)&stru_140C00F40 + 7280, 0x200000000000i64);
    if( result )
    {
      v23 = a1;
      v29 = &v23;
      v30 = 4i64;
      v31 = &v24;
      v24 = a2;
      v33 = v36;
      v35 = v5[1];
      v36[0] = *(unsigned __int16 *)v5;
      v37 = v40;
      v40[0] = CommandLine.Length;
      v27 = v25;
      v41 = &v27;
      v32 = 4i64;
      v34 = 2i64;
      v36[1] = 0;
      v38 = 2i64;
      v39 = v20;
      v40[1] = 0;
      v42 = 8i64;
      result = tlgWriteTransfer_EtwWriteTransfer(
                 (__int64)&stru_140C00F40 + 7280,
                 (unsigned __int8 *)word_14002C73A,
                 0i64,
                 0i64,
                 9u,
                 &v28);
    }
  }
  if( v20 )
    return(unsigned __int8)ExFreePoolWithTag(v20, 0);
  return result;
}

Referenced by: