tlgWriteTransfer_EtwWriteTransfer

NTSTATUS __fastcall tlgWriteTransfer_EtwWriteTransfer(
        __int64 a1,
        unsigned __int8 *a2,
        const _GUID *ActivityId,
        const _GUID *RelatedActivityId,
        ULONG UserDataCount,
        PEVENT_DATA_DESCRIPTOR UserData){
  _EVENT_DESCRIPTOR EventDescriptor; 

  *(_DWORD *)&EventDescriptor.Id = *a2 << 24;
  *(_DWORD *)&EventDescriptor.Level = *(unsigned __int16 *)(a2 + 1);
  EventDescriptor.Keyword = *(_QWORD *)(a2 + 3);
  UserData->Ptr = *(_QWORD *)(a1 + 8);
  UserData->Size = **(unsigned __int16 **)(a1 + 8);
  UserData->Reserved = 2;
  UserData[1].Ptr = (unsigned __int64)(a2 + 11);
  UserData[1].Size = *(unsigned __int16 *)(a2 + 11);
  UserData[1].Reserved = 1;
  return EtwWriteEx(
           *(_QWORD *)(a1 + 32),
           &EventDescriptor,
           0i64,
           0,
           (_LPCGUID)ActivityId,
           (_LPCGUID)RelatedActivityId,
           UserDataCount,
           UserData);
}

Referenced by: