IopLogAuditIoRegisterNotificationEvent

VOID __stdcall IopLogAuditIoRegisterNotificationEvent(
        EVENT_DESCRIPTOR *EventDescriptor,
        DEVICE_OBJECT *DeviceObject,
        INT64 ReturnCode){
  UINT64 v3; 
  __int64 v5; 
  unsigned int v6; 
  unsigned __int64 v7; 
  __int64 v8; 
  unsigned int v9; 
  __int64 v10; 
  __int16 v11; 
  int v12; 
  EVENT_DATA_DESCRIPTOR UserData[3]; 
  v3 = EtwApiCallsProvRegHandle;
  v12 = 0;
  if( EtwApiCallsProvRegHandle )
  {
    v5 = *((_QWORD *)DeviceObject + 1);
    v6 = 0;
    v11 = 0;
    if( v5 )
    {
      v7 = *(_QWORD *)(v5 + 64);
      if( v7 )
      {
        v6 = 1;
        UserData[0].Size = *(unsigned __int16 *)(v5 + 56);
        UserData[0].Ptr = v7;
        UserData[0].Reserved = 0;
      }
    }
    v8 = v6;
    v9 = v6 + 1;
    UserData[v8].Ptr = (unsigned __int64)&v11;
    *(_QWORD *)&UserData[v8].Size = 2i64;
    v10 = v9;
    UserData[v10].Ptr = (unsigned __int64)&v12;
    *(_QWORD *)&UserData[v10].Size = 4i64;
    EtwWrite(v3, EventDescriptor, 0i64, v9 + 1, UserData);
  }
}

Referenced by: