CmpTraceHiveLoadStart
VOID __stdcall CmpTraceHiveLoadStart(UNICODE_STRING *SourceFile, UINT64 LoadFlags){
EVENT_DESCRIPTOR *v2;
UINT64 v3;
__int16 v5;
EVENT_DESCRIPTOR EventDescriptor;
EVENT_DATA_DESCRIPTOR UserData;
__int16 *v8;
__int64 v9;
int *v10;
__int64 v11;
int v12;
v12 = LoadFlags;
v3 = EtwpRegTraceHandle;
EventDescriptor = (EVENT_DESCRIPTOR)REGISTRY_PERF_EVENT_HIVE_LOAD_START;
if( EtwEventEnabled(EtwpRegTraceHandle, &EventDescriptor, v2) )
{
UserData.Ptr = (unsigned __int64)SourceFile->Buffer;
UserData.Size = SourceFile->Length;
v8 = &v5;
v10 = &v12;
v5 = 0;
UserData.Reserved = 0;
v9 = 2i64;
v11 = 4i64;
EtwWrite(v3, &EventDescriptor, 0i64, 3ui64, &UserData);
}
}Referenced by:
CmLoadDifferencingKey