KsepDsEventDriverUnload
VOID __stdcall KsepDsEventDriverUnload(_DRIVER_OBJECT *DriverObject, VOID *BaseAddress, VOID *ptr32){
REGHANDLE v3;
_EVENT_DATA_DESCRIPTOR UserData;
VOID **v5;
int v6;
int v7;
_DRIVER_OBJECT *v8;
VOID *v9;
v9 = BaseAddress;
v8 = DriverObject;
v3 = *(&stru_140CF2E80 + 627);
if( *(&stru_140CF2E80 + 627) )
{
if( EtwEventEnabled(*(&stru_140CF2E80 + 627), &KseDsEventDriverUnload) )
{
UserData.Reserved = 0;
v7 = 0;
UserData.Ptr = (unsigned __int64)&v8;
UserData.Size = 8;
v5 = &v9;
v6 = 8;
EtwWriteEx(v3, &KseDsEventDriverUnload, 0i64, 0, 0, 0, 2u, &UserData);
}
}
}Referenced by:
KseDsCallbackHookDriverUnload
KseDsHookDriverUntargeted