EtwpLogRegistryEvent

VOID __stdcall EtwpLogRegistryEvent(
        UINT64 LoggerId,
        UINT8 Type,
        INT64 Status,
        UINT64 Index,
        VOID *Kcb,
        _LARGE_INTEGER *StartTime,
        _UNICODE_STRING *KeyName){
  unsigned int v7; 
  __int16 v8; 
  unsigned int v9; 
  INT16 a6; 
  wchar_t *Buffer; 
  int v12; 
  __int64 v13; 
  INT64 a5; 
  UINT64 a7; 
  LONGLONG QuadPart; 
  int v17; 
  int v18; 
  VOID *v19; 
  __int64 v20; 
  INT64 a2; 
  int v22; 
  int v23; 
  wchar_t *v24; 
  int v25; 
  int v26; 

  v20 = 0i64;
  v23 = 0;
  v7 = LoggerId;
  v8 = Type;
  v9 = 1;
  a6 = v8 | 0x900;
  v17 = Status;
  v18 = Index;
  v22 = 24;
  QuadPart = StartTime->QuadPart;
  v19 = Kcb;
  a2 = (INT64)&QuadPart;
  if( KeyName )
  {
    Buffer = KeyName->Buffer;
    v12 = KeyName->Length & 0xFFFE;
    if( Buffer )
    {
      if( (KeyName->Length & 0xFFFE) != 0 )
      {
        v26 = 0;
        v9 = 2;
        v24 = Buffer;
        v25 = v12;
      }
    }
  }
  v13 = 2i64 * v9;
  LODWORD(a7) = 5249282;
  *(&v23 + 2 * v13) = 0;
  *(&a2 + v13) = (INT64)&EtwpNull;
  *(&v22 + 2 * v13) = 2;
  LODWORD(a5) = v9 + 1;
  EtwpLogSystemEventUnsafe(
    (_ETW_SILODRIVERSTATE *)EtwpHostSiloState,
    (INT64)&a2,
    (INT64)KeGetCurrentThread(),
    v7,
    a5,
    a6,
    a7);
}

Referenced by: