CmpTraceHiveRestoreStart

VOID __stdcall CmpTraceHiveRestoreStart(PVOID SourceFile, UINT64 Flags){
  unsigned int v3; 
  __int64 v4; 
  unsigned int v5; 
  __int64 v6; 
  REGHANDLE v7; 
  __int16 v8; 
  _UNICODE_STRING UnicodeString; 
  _EVENT_DESCRIPTOR EventDescriptor; 
  _EVENT_DATA_DESCRIPTOR UserData[3]; 
  int v12; 

  v12 = Flags;
  EventDescriptor = (_EVENT_DESCRIPTOR)REGISTRY_PERF_EVENT_HIVE_RESTORE_START;
  UnicodeString = 0i64;
  if( EtwEventEnabled(EtwpRegTraceHandle, &EventDescriptor) )
  {
    v3 = 0;
    if( SourceFile )
    {
      if( CmpQueryNameString(SourceFile, &UnicodeString) < 0 )
        return;
      v3 = 1;
      UserData[0].Ptr = (unsigned __int64)UnicodeString.Buffer;
      UserData[0].Size = UnicodeString.Length;
      UserData[0].Reserved = 0;
    }
    v4 = v3;
    v8 = 0;
    v5 = v3 + 1;
    UserData[v4].Ptr = (unsigned __int64)&v8;
    *(_QWORD *)&UserData[v4].Size = 2i64;
    v6 = v5;
    UserData[v6].Ptr = (unsigned __int64)&v12;
    v7 = EtwpRegTraceHandle;
    *(_QWORD *)&UserData[v6].Size = 4i64;
    EtwWrite(v7, &EventDescriptor, 0, v5 + 1, UserData);
    if( SourceFile )
      RtlFreeAnsiString(&UnicodeString);
  }
}

Referenced by: