KiTraceLogNmiCallback

void __fastcall KiTraceLogNmiCallback(unsigned __int64 a1, __int64 a2, WCHAR a3){
  __int64 v4; 
  int v5; 
  int v6; 
  int v7; 
  INT64 i; 
  unsigned __int64 v9; 
  int v10; 
  int v11; 
  int DestinationString; 
  _UNICODE_STRING DestinationString_8; 
  __int64 v14; 
  unsigned __int64 v15; 
  _EVENT_DATA_DESCRIPTOR v16; 
  int *v17; 
  int v18; 
  int v19; 
  wchar_t *Buffer; 
  int v21[2]; 
  __int64 *v22; 
  int v23; 
  int v24; 
  int *v25; 
  int v26; 
  int v27; 
  int *v28; 
  int v29; 
  int v30; 
  int *p_DestinationString; 
  int v32; 
  int v33; 
  unsigned __int64 *v34; 
  int v35; 
  int v36; 
  _UNICODE_STRING *p_DestinationString_8; 
  int v38; 
  int v39; 

  DestinationString_8 = 0i64;
  RtlInitUnicodeString(&DestinationString_8, (PCWSTR)&stru_1407D2340._Xmm13);
  v4 = -1i64;
  v5 = 0;
  v6 = 0;
  v7 = 0;
  if( (a1 < PsNtosImageBase || a1 >= PsNtosImageEnd) && (a1 < (unsigned __int64)PsHalImageBase || a1 >= PsHalImageEnd) )
  {
    ExAcquireResourceSharedLite((UINT64)&PsLoadedModuleResource, 1);
    for( i = PsLoadedModuleList; (INT64 *)i != &PsLoadedModuleList; i = *(_QWORD *)i )
    {
      v9 = *(_QWORD *)(i + 48);
      if( a1 >= v9 && a1 < v9 + *(unsigned int *)(i + 64) )
      {
        v6 = *(_DWORD *)(i + 120);
        v4 = *(_QWORD *)(i + 48);
        v7 = *(_DWORD *)(i + 156);
        v5 = *(_DWORD *)(i + 64);
        DestinationString_8 = *(_UNICODE_STRING *)(i + 72);
        break;
      }
    }
    if( *(&stru_140C00F40 + 716) > 5u )
    {
      if( tlgKeywordOn((__int64)&stru_140C00F40 + 2864, 0x400000000000i64) )
      {
        v19 = 0;
        v21[1] = 0;
        v24 = 0;
        v27 = 0;
        v30 = 0;
        v33 = 0;
        v36 = 0;
        v39 = 0;
        v17 = v21;
        Buffer = DestinationString_8.Buffer;
        v21[0] = DestinationString_8.Length;
        v22 = &v14;
        v25 = &v10;
        v28 = &v11;
        p_DestinationString = &DestinationString;
        v34 = &v15;
        p_DestinationString_8 = &DestinationString_8;
        v23 = 8;
        v26 = 4;
        v29 = 4;
        v32 = 4;
        v35 = 8;
        v38 = 8;
        v18 = 2;
        v14 = v4;
        v10 = v5;
        v11 = v6;
        DestinationString = v7;
        v15 = a1;
        *(_QWORD *)&DestinationString_8.Length = 0x1000000i64;
        tlgWriteTransfer_EtwWriteTransfer(
          (__int64)&stru_140C00F40 + 2864,
          (unsigned __int8 *)&word_140024926,
          0i64,
          0i64,
          0xAu,
          &v16);
      }
    }
    ExReleaseResourceLite(&PsLoadedModuleResource);
  }
}

Referenced by: