SeEtwWriteKMCveEvent
NTSTATUS __stdcall SeEtwWriteKMCveEvent(UNICODE_STRING *CveId, UNICODE_STRING *AdditionalDetails){
unsigned int v3;
__int64 v4;
UINT64 v5;
UINT64 UserDataCount;
__int16 v7[8];
EVENT_DATA_DESCRIPTOR UserData;
__int16 *v9;
__int64 v10;
__int128 v11;
__int128 v12;
v11 = 0i64;
v12 = 0i64;
v7[0] = 0;
if( !CveId )
return -1073741811;
UserData.Ptr = (unsigned __int64)CveId->Buffer;
v3 = 2;
UserData.Size = CveId->Length;
v9 = v7;
UserData.Reserved = 0;
v10 = 2i64;
if( AdditionalDetails )
{
v3 = 3;
*(_QWORD *)&v11 = AdditionalDetails->Buffer;
*((_QWORD *)&v11 + 1) = AdditionalDetails->Length;
}
v4 = 2i64 * v3;
*(&UserData.Ptr + v4) = (unsigned __int64)v7;
v5 = EtwCVEAuditProvRegHandle;
*((_QWORD *)&UserData.Size + v4) = 2i64;
LODWORD(UserDataCount) = v3 + 1;
return EtwWriteEx(v5, (EVENT_DESCRIPTOR *)&CVE_AUDIT_DETECT_KM, 0i64, 0i64, 0i64, 0i64, UserDataCount, &UserData);
}Referenced by:
No references.