EtwpTiParseContextRecord
NTSTATUS __stdcall EtwpTiParseContextRecord(INT64 a1, INT64 a2, INT64 a3){
int v4;
unsigned __int16 v6;
v4 = a2;
v6 = 0;
memset((VOID *)a1, 0i64, 0x60u);
if( (v4 & 0x10001) == 65537 )
{
v6 = 1;
*(_QWORD *)a1 = *(unsigned int *)(a3 + 184);
*(_QWORD *)(a1 + 8) = *(unsigned int *)(a3 + 196);
*(_QWORD *)(a1 + 24) = *(unsigned int *)(a3 + 180);
}
if( (v4 & 0x10002) == 65538 )
{
*(_QWORD *)(a1 + 32) = *(unsigned int *)(a3 + 176);
v6 |= 2u;
*(_QWORD *)(a1 + 40) = *(unsigned int *)(a3 + 172);
*(_QWORD *)(a1 + 48) = *(unsigned int *)(a3 + 168);
*(_QWORD *)(a1 + 56) = *(unsigned int *)(a3 + 164);
*(_QWORD *)(a1 + 64) = *(unsigned int *)(a3 + 160);
*(_QWORD *)(a1 + 72) = *(unsigned int *)(a3 + 156);
*(_OWORD *)(a1 + 80) = 0i64;
}
if( (v4 & 0x100001) == 1048577 )
{
v6 |= 1u;
*(_QWORD *)a1 = *(_QWORD *)(a3 + 248);
*(_QWORD *)(a1 + 8) = *(_QWORD *)(a3 + 152);
*(_QWORD *)(a1 + 16) = 0i64;
}
if( (v4 & 0x100002) == 1048578 )
{
v6 |= 2u;
*(_QWORD *)(a1 + 24) = *(_QWORD *)(a3 + 160);
*(_QWORD *)(a1 + 32) = *(_QWORD *)(a3 + 120);
*(_QWORD *)(a1 + 40) = *(_QWORD *)(a3 + 128);
*(_QWORD *)(a1 + 48) = *(_QWORD *)(a3 + 136);
*(_QWORD *)(a1 + 56) = *(_QWORD *)(a3 + 144);
*(_QWORD *)(a1 + 64) = *(_QWORD *)(a3 + 168);
*(_QWORD *)(a1 + 72) = *(_QWORD *)(a3 + 176);
*(_QWORD *)(a1 + 80) = *(_QWORD *)(a3 + 184);
*(_QWORD *)(a1 + 88) = *(_QWORD *)(a3 + 192);
}
return v6;
}Referenced by:
EtwTiLogSetContextThread