CmpTraceHiveSaveStart
VOID __fastcall CmpTraceHiveSaveStart(_CM_KEY_CONTROL_BLOCK *KeyControlBlock){
EVENT_DESCRIPTOR *v1;
_UNICODE_STRING *v3;
unsigned int Length;
__int16 v5;
_UNICODE_STRING *KeyPath;
EVENT_DESCRIPTOR EventDescriptor;
EVENT_DATA_DESCRIPTOR UserData;
__int16 *v9;
__int64 v10;
EventDescriptor = (EVENT_DESCRIPTOR)REGISTRY_PERF_EVENT_HIVE_SAVE_START;
if( EtwEventEnabled(EtwpRegTraceHandle, &EventDescriptor, v1) )
{
v5 = 0;
KeyPath = 0i64;
CmpConstructNameWithStatus(KeyControlBlock, &KeyPath);
v3 = KeyPath;
if( KeyPath )
{
Length = KeyPath->Length;
UserData.Ptr = (unsigned __int64)KeyPath->Buffer;
UserData.Size = Length;
v9 = &v5;
UserData.Reserved = 0;
v10 = 2i64;
EtwWrite(EtwpRegTraceHandle, &EventDescriptor, 0i64, 2ui64, &UserData);
CmpFreeTransientPoolWithTag(v3, 0x624E4D43ui64);
}
}
}Referenced by:
CmSaveKey