SeEtwWriteKMCveEvent

NTSTATUS __stdcall SeEtwWriteKMCveEvent(_UNICODE_STRING *CveId, _UNICODE_STRING *AdditionalDetails){
  unsigned int v3; 
  __int64 v4; 
  REGHANDLE v5; 
  __int16 v6[8]; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  __int16 *v8; 
  __int64 v9; 
  __int128 v10; 
  __int128 v11; 

  v10 = 0i64;
  v11 = 0i64;
  v6[0] = 0;
  if( !CveId )
    return -1073741811;
  UserData.Ptr = (unsigned __int64)CveId->Buffer;
  v3 = 2;
  UserData.Size = CveId->Length;
  v8 = v6;
  UserData.Reserved = 0;
  v9 = 2i64;
  if( AdditionalDetails )
  {
    v3 = 3;
    *(_QWORD *)&v10 = AdditionalDetails->Buffer;
    *((_QWORD *)&v10 + 1) = AdditionalDetails->Length;
  }
  v4 = 2i64 * v3;
  *(&UserData.Ptr + v4) = (unsigned __int64)v6;
  v5 = *(&ExBootDevicesRemovedEvent + 252);
  *((_QWORD *)&UserData.Size + v4) = 2i64;
  return EtwWriteEx(v5, &CVE_AUDIT_DETECT_KM, 0i64, 0, 0, 0, v3 + 1, &UserData);
}

Referenced by: