PerfLogImageLoad

VOID __stdcall PerfLogImageLoad(_UNICODE_STRING *ImageName, VOID *ProcessId, _IMAGE_INFO *ImageInfo){
  int v5; 
  ULONG Properties; 
  __int64 v7; 
  INT64 v8; 
  _WMI_IMAGELOAD_INFORMATION ImageInfoa[2]; 
  __int64 v10; 
  int v11; 
  __int64 v12; 
  char v13; 
  char v14[3]; 
  __int64 v15; 
  __int64 v16; 
  __int64 v17; 
  __int64 v18; 
  PGET_UPDATED_BUS_RESOURCE v19[3]; 
  int Length; 
  int v21; 
  __int64 *v22; 
  __int64 v23; 

  *(_QWORD *)ImageInfoa = 0i64;
  v18 = 0i64;
  if( ImageName && ImageName->Length && ImageName->Buffer )
  {
    if( ProcessId )
      v5 = *((_DWORD *)ProcessId + 272);
    else
      v5 = 0;
    *(_QWORD *)ImageInfoa = ImageInfo->ImageBase;
    v10 = *(_QWORD *)&ImageInfo->ImageSectionNumber;
    v11 = v5;
    *(_WORD *)&v14[1] = 0;
    v16 = 0i64;
    v17 = 0i64;
    v12 = 0i64;
    v15 = 0i64;
    Properties = ImageInfo->anonymous_0.Properties;
    v13 = (ImageInfo->anonymous_0.Properties >> 12) & 0xF;
    *(_WORD *)v14 = BYTE2(Properties) & 7;
    LODWORD(v7) = RtlImageNtHeader(*(UINT64 *)ImageInfoa);
    if( v7 )
    {
      LODWORD(v12) = *(_DWORD *)(v7 + 88);
      HIDWORD(v12) = *(_DWORD *)(v7 + 8);
      v15 = *(_QWORD *)(v7 + 48);
    }
    if( EtwpHostSiloState != -4516 && (*(_DWORD *)(EtwpHostSiloState + 4516) & 4) != 0 )
      EtwpPsProvTraceImage(ImageName, ImageInfoa, 0x1401u, 0i64);
    v19[0] = (PGET_UPDATED_BUS_RESOURCE)ImageInfoa;
    v19[1] = (PGET_UPDATED_BUS_RESOURCE)56;
    v19[2] = (PGET_UPDATED_BUS_RESOURCE)ImageName->Buffer;
    Length = ImageName->Length;
    v21 = 0;
    v22 = &EtwpNull;
    v23 = 2i64;
    if( ProcessId )
    {
      LODWORD(v8) = 5249283;
      EtwTraceSiloKernelEvent(*((_QWORD *)ProcessId + 270), v19, 3ui64, 4ui64, 778, v8);
    }
    else
    {
      EtwTraceKernelEvent((__int64)v19, 3u, 4u, 0x30Au, 0x501903u);
    }
  }
}

Referenced by: