EtwpCloseRegistrationObject

VOID __stdcall EtwpCloseRegistrationObject(
        _EPROCESS *Process,
        VOID *Object,
        UINT64 ProcessHandleCount,
        UINT64 SystemHandleCount){
  __int64 v5; 
  __int64 v6; 

  if( SystemHandleCount == 1 )
  {
    if( (*((_BYTE *)Object + 98) & 2) != 0 )
    {
      if( EtwEventEnabled(*(&ExBootDevicesRemovedEvent + 241), &ETW_EVENT_PROVIDER_UNREGISTERS) )
        EtwpEventWriteTemplateSessAndProv(
          v5,
          &ETW_EVENT_PROVIDER_UNREGISTERS,
          v6,
          1,
          0i64,
          *((_QWORD *)Object + 4) + 40i64);
    }
    _InterlockedOr16((volatile signed __int16 *)Object + 49, 0x40u);
  }
}

Referenced by: