EtwpLogRegistryEvent

VOID __stdcall EtwpLogRegistryEvent(
        UINT64 LoggerId,
        UINT8 Type,
        INT64 Status,
        UINT64 Index,
        PVOID Kcb,
        LARGE_INTEGER *StartTime,
        UNICODE_STRING *KeyName){
  unsigned int v7; 
  __int16 v8; 
  unsigned int v9; 
  __int16 v10; 
  wchar_t *Buffer; 
  int v12; 
  __int64 v13; 
  LONGLONG QuadPart; 
  int v15; 
  int v16; 
  PVOID v17; 
  __int64 v18; 
  LONGLONG *p_QuadPart; 
  int v20; 
  int v21; 
  wchar_t *v22; 
  int v23; 
  int v24; 
  v18 = 0i64;
  v21 = 0;
  v7 = LoggerId;
  v8 = Type;
  v9 = 1;
  v10 = v8 | 0x900;
  v15 = Status;
  v16 = Index;
  v20 = 24;
  QuadPart = StartTime->QuadPart;
  v17 = Kcb;
  p_QuadPart = &QuadPart;
  if( KeyName )
  {
    Buffer = KeyName->Buffer;
    v12 = KeyName->Length & 0xFFFE;
    if( Buffer )
    {
      if( (KeyName->Length & 0xFFFE) != 0 )
      {
        v24 = 0;
        v9 = 2;
        v22 = Buffer;
        v23 = v12;
      }
    }
  }
  v13 = 2i64 * v9;
  *(&v21 + 2 * v13) = 0;
  (&p_QuadPart)[v13] = &EtwpNull;
  *(&v20 + 2 * v13) = 2;
  EtwpLogSystemEventUnsafe(
    EtwpHostSiloState,
    (__int64)&p_QuadPart,
    (__int64)KeGetCurrentThread(),
    v7,
    v9 + 1,
    v10,
    0x501902u);
}

Referenced by: