EtwpWriteProcessStarted

VOID __stdcall EtwpWriteProcessStarted(
        _EPROCESS *Process,
        const _ETW_OTHER_PROCESS_INFO *OtherInfo,
        const _ETW_PACKAGE_IDENTITY *PackageInfo,
        const _UNICODE_STRING *CommandLine,
        const _TOKEN_USER *TokenUser){
  _OBJECT_NAME_INFORMATION *ImageFileName; 
  _EPROCESS *v10; 
  __int64 v11; 
  int v12; 
  unsigned __int8 *Sid; 
  int v14; 
  int UniqueProcessId; 
  int InheritedFromUniqueProcessId; 
  NTSTATUS ProcessSessionId; 
  unsigned int ImageChecksum; 
  __int64 v19; 
  _LARGE_INTEGER CreateTime; 
  UINT64 ProcessStartKey; 
  unsigned __int64 SequenceNumber; 
  unsigned __int64 CreateInterruptTime; 
  __int64 v24; 
  _EVENT_DATA_DESCRIPTOR v25; 
  _LARGE_INTEGER *p_CreateTime; 
  __int64 v27; 
  int *p_UniqueProcessId; 
  __int64 v29; 
  int *p_InheritedFromUniqueProcessId; 
  __int64 v31; 
  NTSTATUS *p_ProcessSessionId; 
  __int64 v33; 
  int *v34; 
  __int64 v35; 
  __int64 v36; 
  int v37[2]; 
  UINT64 *p_ProcessStartKey; 
  __int64 v39; 
  unsigned __int64 *p_SequenceNumber; 
  __int64 v41; 
  unsigned __int64 *p_CreateInterruptTime; 
  __int64 v43; 
  __int64 *v44; 
  __int64 v45; 
  unsigned int *p_ImageChecksum; 
  __int64 v47; 
  __int64 *v48; 
  __int64 v49; 
  char v50[16]; 
  char v51[16]; 
  unsigned __int8 *v52; 
  int v53; 
  int v54; 
  int *v55; 
  __int64 v56; 
  wchar_t *Buffer; 
  int v58[2]; 

  ImageFileName = (_OBJECT_NAME_INFORMATION *)&EmptyUnicodeString;
  if( Process->SeAuditProcessCreationInfo.ImageFileName )
    ImageFileName = Process->SeAuditProcessCreationInfo.ImageFileName;
  if( *(&stru_140C00F40 + 1806) > 5u && tlgKeywordOn((__int64)&stru_140C00F40 + 7224, 3i64) )
  {
    CreateTime = Process->CreateTime;
    p_CreateTime = &CreateTime;
    UniqueProcessId = (int)Process->UniqueProcessId;
    p_UniqueProcessId = &UniqueProcessId;
    InheritedFromUniqueProcessId = (int)Process->InheritedFromUniqueProcessId;
    p_InheritedFromUniqueProcessId = &InheritedFromUniqueProcessId;
    v27 = 8i64;
    v29 = 4i64;
    v31 = 4i64;
    ProcessSessionId = PsGetProcessSessionId((INT64)Process);
    v33 = 4i64;
    p_ProcessSessionId = &ProcessSessionId;
    v35 = 2i64;
    v34 = v37;
    v36 = *((_QWORD *)ImageFileName + 1);
    v37[0] = *(_WORD *)ImageFileName;
    v37[1] = 0;
    ProcessStartKey = PsGetProcessStartKey((INT64)Process);
    p_ProcessStartKey = &ProcessStartKey;
    SequenceNumber = Process->SequenceNumber;
    p_SequenceNumber = &SequenceNumber;
    CreateInterruptTime = Process->CreateInterruptTime;
    p_CreateInterruptTime = &CreateInterruptTime;
    v39 = 8i64;
    v41 = 8i64;
    v43 = 8i64;
    LODWORD(v11) = MmGetSessionCreateTime(v10);
    v24 = v11;
    v45 = 8i64;
    v44 = &v24;
    ImageChecksum = OtherInfo->ImageChecksum;
    p_ImageChecksum = &ImageChecksum;
    LODWORD(v19) = OtherInfo->TimeDateStamp;
    v48 = &v19;
    v47 = 4i64;
    v49 = 4i64;
    tlgCreate1Sz_wchar_t((__int64)v50, &PackageInfo->PackageName[4]);
    tlgCreate1Sz_wchar_t((__int64)v51, &PackageInfo->ApplicationName[4]);
    if( TokenUser )
      Sid = (unsigned __int8 *)TokenUser->User.Sid;
    else
      Sid = (unsigned __int8 *)SeNullSid;
    v14 = Sid[1];
    v52 = Sid;
    v54 = v12;
    v56 = 2i64;
    v58[1] = v12;
    v53 = 4 * v14 + 8;
    v55 = v58;
    Buffer = CommandLine->Buffer;
    v58[0] = CommandLine->Length;
    tlgWriteTransfer_EtwWriteTransfer(
      (__int64)&stru_140C00F40 + 7224,
      (unsigned __int8 *)&dword_14002B85C,
      0i64,
      0i64,
      0x13u,
      &v25);
  }
}

Referenced by: