MmNotifyProcessInSwapTrigger

VOID __stdcall MmNotifyProcessInSwapTrigger(_EPROCESS *Process){
  __int64 v1; 
  __int64 v2; 
  int v3; 
  __int64 v4; 
  __int64 v5; 
  int v6; 
  int v7; 
  int v8; 
  __int64 v9; 
  __int64 v10[4]; 
  INT64 v11[3]; 
  int v12; 
  int v13; 
  __int64 *v14; 
  int v15; 
  int v16; 

  if( (Process->Vm.Instance.Flags._bf_0 & 0x60) == 64 && *(&stru_140C4DB30 + 542) && **(&stru_140C4DB30 + 542) > 5u )
  {
    if( tlgKeywordOn(*(&stru_140C4DB30 + 542), 0x400000000008i64) )
    {
      tlgCreate1Sz_char((INT64)v11, (const CHAR *)(v1 + 1448));
      v3 = *(_DWORD *)(v2 + 1088);
      v13 = 0;
      v16 = 0;
      v11[2] = (INT64)&v8;
      v14 = &v9;
      v8 = v3;
      v12 = 4;
      v9 = 0x1000000i64;
      v15 = 8;
      tlgWriteEx_EtwWriteEx(v5, (unsigned __int8 *)&byte_1400249BF, v4, 1u, v6, v7, 5u, (__int64)v10);
    }
  }
}

Referenced by: