EtwTraceMemoryAcg

VOID __stdcall EtwTraceMemoryAcg(UINT64 Flag){
  REGHANDLE v1; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  int v3; 

  v3 = Flag;
  v1 = *(&ExBootDevicesRemovedEvent + 251);
  if( EtwProviderEnabled(*(&ExBootDevicesRemovedEvent + 251), 0, 0x100ui64) )
  {
    *(_QWORD *)&UserData.Size = 4i64;
    UserData.Ptr = (unsigned __int64)&v3;
    EtwWriteEx(v1, &KERNEL_MEM_EVENT_ACG, 0i64, 1u, 0, 0, 1u, &UserData);
  }
}

Referenced by:

MiArbitraryCodeBlocked