EtwpPsProvTraceImage

VOID __stdcall EtwpPsProvTraceImage(
        _UNICODE_STRING *ImageName,
        _WMI_IMAGELOAD_INFORMATION *ImageInfo,
        UINT16 HookId,
        UINT64 LocksHeld){
  const _EVENT_DESCRIPTOR *v5; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  _WMI_IMAGELOAD_INFORMATION *v7; 
  int v8; 
  int v9; 
  _WMI_IMAGELOAD_INFORMATION *v10; 
  int v11; 
  int v12; 
  _WMI_IMAGELOAD_INFORMATION *v13; 
  int v14; 
  int v15; 
  _WMI_IMAGELOAD_INFORMATION *v16; 
  int v17; 
  int v18; 
  _WMI_IMAGELOAD_INFORMATION *v19; 
  int v20; 
  int v21; 
  wchar_t *Buffer; 
  int Length; 
  int v24; 
  __int64 *v25; 
  int v26; 
  int v27; 

  if( HookId == 5121 )
  {
    v5 = &ImageLoad;
LABEL_3:
    UserData.Reserved = 0;
    v9 = 0;
    v12 = 0;
    v15 = 0;
    v18 = 0;
    v21 = 0;
    v24 = 0;
    v27 = 0;
    v7 = ImageInfo + 2;
    v11 = 4;
    v10 = ImageInfo + 4;
    v14 = 4;
    v13 = ImageInfo + 5;
    v16 = ImageInfo + 6;
    v19 = ImageInfo + 8;
    Buffer = ImageName->Buffer;
    Length = ImageName->Length;
    v25 = &EtwpNull;
    v17 = 4;
    UserData.Ptr = (unsigned __int64)ImageInfo;
    UserData.Size = 8;
    v8 = 8;
    v20 = 8;
    v26 = 2;
    EtwWriteEx(*(&ExBootDevicesRemovedEvent + 245), v5, 0i64, LocksHeld != 0, 0, 0, 8u, &UserData);
    return;
  }
  if( HookId == 5122 )
  {
    v5 = (const _EVENT_DESCRIPTOR *)ImageUnload;
    goto LABEL_3;
  }
}

Referenced by: