CmpEtwDumpKcb

VOID __stdcall CmpEtwDumpKcb(_CM_KEY_CONTROL_BLOCK *kcb, UINT8 Type){
  void(__fastcall *v2)(__int64, __int128 *, _QWORD, _QWORD, _CM_KEY_CONTROL_BLOCK *, _UNICODE_STRING *); 
  __int64 v5; 
  _UNICODE_STRING *v6; 
  _UNICODE_STRING *KeyPath; 
  KAPC_STATE ApcState; 
  __int128 v9[2]; 
  v2 = *(void(__fastcall **)(__int64, __int128 *, _QWORD, _QWORD, _CM_KEY_CONTROL_BLOCK *, _UNICODE_STRING *))((char *)&NlsMbCodePageTag + 7);
  memset(v9, 0, sizeof(v9));
  memset(&ApcState, 0, sizeof(ApcState));
  if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
  {
    CmpAttachToRegistryProcess(&ApcState);
    KeyPath = 0i64;
    CmpConstructNameWithStatus(kcb, &KeyPath);
    v6 = KeyPath;
    if( KeyPath )
    {
      LOBYTE(v5) = Type;
      v2(v5, v9, 0i64, 0i64, kcb, KeyPath);
      CmpFreeTransientPoolWithTag(v6, 0x624E4D43ui64);
    }
    KiUnstackDetachProcess(&ApcState, 0i64);
  }
}

Referenced by: