EtwTimLogProhibitLowILImageMap

VOID __stdcall EtwTimLogProhibitLowILImageMap(INT64 a1, _EPROCESS *a2, UINT16 *a3){
  __int64 *v4; 
  const wchar_t *v5; 
  int v6; 
  _OBJECT_NAME_INFORMATION *ImageFileName; 
  unsigned int v9; 
  unsigned __int16 v10; 
  int v11; 
  const wchar_t *v12; 
  int Length; 
  __int16 v14; 
  int v15; 
  NTSTATUS v16; 
  int v17; 
  unsigned int v18; 
  __int16 v19; 
  __int64 v20; 
  __int64 v21; 
  ULONG v22; 
  const _EVENT_DESCRIPTOR *v23; 
  wchar_t *v24; 
  __int16 v25[2]; 
  int v26; 
  __int16 v27; 
  int v28; 
  __int64 CommandLine; 
  _UNICODE_STRING CommandLine_8; 
  __int64 v31; 
  _EVENT_DATA_DESCRIPTOR v32; 
  int *v33; 
  __int64 v34; 
  int *v35; 
  __int64 v36; 
  __int64 v37; 
  int v38[2]; 
  int *v39; 
  __int64 v40; 
  wchar_t *v41; 
  int v42[2]; 
  __int64 *v43; 
  __int64 v44; 
  int *v45; 
  __int64 v46; 
  __int64 v47; 
  int v48[2]; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  const wchar_t *v50; 
  int v51; 
  int v52; 
  int *v53; 
  __int64 v54; 
  wchar_t *Buffer; 
  int v56; 
  int v57; 
  __int64 v58[20]; 

  v4 = &EmptyUnicodeString;
  v5 = L"(null)";
  CommandLine = 0i64;
  v6 = a1;
  ImageFileName = a2->SeAuditProcessCreationInfo.ImageFileName;
  CommandLine_8 = 0i64;
  if( ImageFileName )
    v4 = (__int64 *)ImageFileName;
  v9 = 12;
  v10 = *(_WORD *)v4;
  *(_QWORD *)&UserData.Size = 2i64;
  if( v10 )
  {
    v25[0] = v10 >> 1;
    UserData.Ptr = (unsigned __int64)v25;
    v11 = *(unsigned __int16 *)v4;
    v12 = (const wchar_t *)v4[1];
  }
  else
  {
    v25[0] = 6;
    UserData.Ptr = (unsigned __int64)v25;
    v12 = L"(null)";
    v11 = 12;
  }
  v50 = v12;
  v52 = 0;
  v51 = v11;
  EtwpQueryProcessCommandLine(a2, &CommandLine_8);
  v54 = 2i64;
  v53 = &v26;
  if( CommandLine_8.Length )
  {
    Buffer = CommandLine_8.Buffer;
    Length = CommandLine_8.Length;
    v14 = CommandLine_8.Length >> 1;
  }
  else
  {
    Buffer = L"(null)";
    Length = 12;
    v14 = 6;
  }
  LOWORD(v26) = v14;
  v57 = 0;
  v56 = Length;
  v15 = EtwpTiFillProcessIdentity(v58, (__int64)a2, (unsigned __int64 *)&CommandLine);
  v16 = EtwpTiFillThreadIdentity((INT64)(&UserData + (unsigned int)(v15 + 4)), (INT64)KeGetCurrentThread());
  v18 = v16 + v17;
  if( a3 && *a3 )
  {
    v5 = (const wchar_t *)*((_QWORD *)a3 + 1);
    v9 = *a3;
    v19 = *a3 >> 1;
  }
  else
  {
    v19 = 6;
  }
  v27 = v19;
  v20 = 2i64 * v18;
  v21 = 2i64 * (v18 + 1);
  v22 = v18 + 2;
  *(&UserData.Ptr + v20) = (unsigned __int64)&v27;
  v23 = (const _EVENT_DESCRIPTOR *)MITIGATION_AUDIT_PROHIBIT_LOWIL_IMAGE_MAP;
  *((_QWORD *)&UserData.Size + v20) = 2i64;
  *(&UserData.Ptr + v21) = (unsigned __int64)v5;
  if( v6 != 1 )
    v23 = &MITIGATION_ENFORCE_PROHIBIT_LOWIL_IMAGE_MAP;
  *(&UserData.Size + 2 * v21) = v9;
  *(&UserData.Reserved + 2 * v21) = 0;
  EtwWrite(*(&ExBootDevicesRemovedEvent + 248), v23, 0, v22, &UserData);
  v24 = CommandLine_8.Buffer;
  if( *(&stru_140C00F40 + 1820) > 5u && tlgKeywordOn((__int64)&stru_140C00F40 + 7280, 0x400000000000i64) )
  {
    v28 = v6;
    v33 = &v28;
    v34 = 4i64;
    v35 = v38;
    v37 = v4[1];
    v38[0] = *(unsigned __int16 *)v4;
    v39 = v42;
    v42[0] = CommandLine_8.Length;
    v31 = CommandLine;
    v43 = &v31;
    v45 = v48;
    v47 = *((_QWORD *)a3 + 1);
    v48[0] = *a3;
    v36 = 2i64;
    v38[1] = 0;
    v40 = 2i64;
    v41 = v24;
    v42[1] = 0;
    v44 = 8i64;
    v46 = 2i64;
    v48[1] = 0;
    tlgWriteTransfer_EtwWriteTransfer(
      (__int64)&stru_140C00F40 + 7280,
      (unsigned __int8 *)&dword_14002C8B2 + 2,
      0i64,
      0i64,
      0xAu,
      &v32);
  }
  if( v24 )
    ExFreePoolWithTag(v24, 0);
}

Referenced by: