EtwTiLogReadWriteVm

CHAR __stdcall EtwTiLogReadWriteVm(INT64 a1, INT64 a2, INT64 a3, INT64 a4, CHAR a5, CHAR a6){
  _ETHREAD *CurrentThread; 
  int v7; 
  REGHANDLE v10; 
  UINT64 v11; 
  __int64 *v12; 
  __int64 *v13; 
  int v14; 
  NTSTATUS v15; 
  int v16; 
  int v17; 
  int v18; 
  unsigned int v19; 
  __int64 v20; 
  __int64 v21; 
  REGHANDLE v22; 
  unsigned __int64 v24; 
  unsigned __int64 v25; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  __int64 v27[32]; 
  int v28; 

  v28 = a1;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v7 = a4;
  if( CurrentThread->Tcb.PreviousMode == 1 )
  {
    v10 = *(&ExBootDevicesRemovedEvent + 179);
    v11 = 196608i64;
    if( (_DWORD)a4 != 16 )
      v11 = 786432i64;
    LOBYTE(CurrentThread) = EtwProviderEnabled(*(&ExBootDevicesRemovedEvent + 179), 0, v11);
    if( (_BYTE)CurrentThread )
    {
      if( a2 == a3 )
      {
        v13 = THREATINT_READVM_LOCAL;
        v12 = THREATINT_WRITEVM_LOCAL;
      }
      else
      {
        v12 = (__int64 *)&THREATINT_WRITEVM_REMOTE;
        v13 = THREATINT_READVM_REMOTE;
      }
      if( v7 != 16 )
        v13 = v12;
      LOBYTE(CurrentThread) = EtwEventEnabled(v10, (PCEVENT_DESCRIPTOR)v13);
      if( (_BYTE)CurrentThread )
      {
        UserData.Reserved = 0;
        UserData.Ptr = (unsigned __int64)&v28;
        UserData.Size = 4;
        v14 = EtwpTiFillProcessIdentity(v27, a2, &v24);
        v15 = EtwpTiFillThreadIdentity((INT64)(&UserData + (unsigned int)(v14 + 1)), (INT64)KeGetCurrentThread());
        v17 = EtwpTiFillProcessIdentity(&UserData.Ptr + 2 * (unsigned int)(v15 + v16), a3, &v25);
        v19 = v17 + v18;
        v20 = 2i64 * v19++;
        *(&UserData.Reserved + 2 * v20) = 0;
        *(&UserData.Ptr + v20) = (unsigned __int64)&a5;
        *(&UserData.Size + 2 * v20) = 8;
        v21 = 2i64 * v19;
        *(&UserData.Reserved + 2 * v21) = 0;
        *(&UserData.Ptr + v21) = (unsigned __int64)&a6;
        v22 = *(&ExBootDevicesRemovedEvent + 179);
        *(&UserData.Size + 2 * v21) = 8;
        LOBYTE(CurrentThread) = EtwWrite(v22, (PCEVENT_DESCRIPTOR)v13, 0, v19 + 1, &UserData);
      }
    }
  }
  return(char)CurrentThread;
}

Referenced by: