EtwpSysModuleRunDown

VOID __stdcall EtwpSysModuleRunDown(UINT64 LoggerId, UINT8 Start){
  __int16 v4; 
  unsigned int v5; 
  _ETW_SILODRIVERSTATE *v6; 
  unsigned int v7; 
  _ETW_SILODRIVERSTATE *v8; 
  VOID *HypercallPageVa; 
  __int64 v10[3]; 
  __int16 v11; 
  int v12; 
  __int16 v13; 
  _QWORD v14[8]; 
  VOID **p_HypercallPageVa; 
  __int64 v16; 
  __int64 *v17; 
  __int64 v18; 

  v12 = 0;
  v13 = 0;
  memset(v14, 0i64, sizeof(v14));
  HypercallPageVa = 0i64;
  if( !Start )
  {
    v5 = *(_DWORD *)LoggerId;
    v6 = *(_ETW_SILODRIVERSTATE **)(LoggerId + 1080);
    p_HypercallPageVa = (VOID **)&PsNtosImageBase;
    v16 = 8i64;
    EtwpLogKernelEvent((__int64)&p_HypercallPageVa, v6, v5, 1u, 0x1421u, 0x401802u);
    if( !HvlQueryConnection(&HypercallPageVa) )
    {
      v7 = *(_DWORD *)LoggerId;
      v8 = *(_ETW_SILODRIVERSTATE **)(LoggerId + 1080);
      p_HypercallPageVa = &HypercallPageVa;
      v16 = 8i64;
      EtwpLogKernelEvent((__int64)&p_HypercallPageVa, v8, v7, 1u, 0x1422u, 0x401802u);
    }
  }
  v10[2] = LoggerId;
  v10[1] = (__int64)&p_HypercallPageVa;
  v10[0] = (__int64)v14;
  v4 = 5123;
  if( !Start )
    v4 = 5124;
  v11 = v4;
  v16 = 56i64;
  p_HypercallPageVa = (VOID **)v14;
  v18 = 2i64;
  v17 = &EtwpNull;
  *(_OWORD *)&v14[5] = 0i64;
  MmEnumerateSystemImages((__int64(__fastcall *)(INT64 *, __int64))EtwpSystemImageEnumCallback, (__int64)v10);
}

Referenced by: