EtwpTiFillVadEventWrite

NTSTATUS __fastcall EtwpTiFillVadEventWrite(
        PEVENT_DATA_DESCRIPTOR UserData,
        ULONG UserDataCount,
        CHAR a3,
        INT64 a4,
        INT64 a5,
        INT64 a6,
        PCEVENT_DESCRIPTOR EventDescriptor){
  unsigned int v7; 
  int v12; 
  _EVENT_DATA_DESCRIPTOR *v14; 

  v7 = 0;
  if( (_DWORD)a6 )
  {
    v12 = a5;
    do
    {
      if( a3 && _bittest(&v12, v7) )
      {
        UserDataCount += EtwpTiFillVad((INT64)&UserData[UserDataCount], a4 + ((unsigned __int64)v7 << 6));
      }
      else
      {
        v14 = &UserData[UserDataCount];
        v14->Reserved = 0;
        v14->Ptr = (unsigned __int64)&qword_14000AD48;
        v14->Size = 4;
        v14[1].Reserved = 0;
        v14[1].Ptr = (unsigned __int64)&qword_14000AD48;
        v14[1].Size = 8;
        v14[2].Reserved = 0;
        v14[2].Ptr = (unsigned __int64)&qword_14000AD48;
        v14[2].Size = 4;
        v14[3].Reserved = 0;
        v14[3].Ptr = (unsigned __int64)&qword_14000AD48;
        v14[3].Size = 4;
        v14[4].Reserved = 0;
        v14[4].Ptr = (unsigned __int64)&qword_14000AD48;
        v14[4].Size = 8;
        v14[5].Reserved = 0;
        v14[5].Ptr = (unsigned __int64)&qword_14000AD48;
        v14[5].Size = 8;
        v14[6].Reserved = 0;
        UserDataCount += 7;
        v14[6].Ptr = (unsigned __int64)&qword_14000AD48;
        v14[6].Size = 2;
      }
      ++v7;
    }
    while( v7 < (unsigned int)a6 );
  }
  return EtwWriteEx(*(&ExBootDevicesRemovedEvent + 179), EventDescriptor, 0i64, 0, 0, 0, UserDataCount, UserData);
}

Referenced by: