CmpEtwDumpKcb

void __fastcall CmpEtwDumpKcb(__int64 a1, char a2){
  void(__fastcall *v2)(__int64, __int128 *, _QWORD, _QWORD, __int64, _UNICODE_STRING *); 
  __int64 v5; 
  _UNICODE_STRING *v6; 
  _UNICODE_STRING *KeyPath; 
  _KAPC_STATE ApcState; 
  __int128 v9[2]; 

  v2 = *(void(__fastcall **)(__int64, __int128 *, _QWORD, _QWORD, __int64, _UNICODE_STRING *))((char *)&NlsMbCodePageTag
                                                                                              + 7);
  memset(v9, 0, sizeof(v9));
  memset(&ApcState, 0, sizeof(ApcState));
  if( *(BOOLEAN **)((char *)&NlsMbCodePageTag + 7) )
  {
    CmpAttachToRegistryProcess(&ApcState);
    KeyPath = 0i64;
    CmpConstructNameWithStatus((_CM_KEY_CONTROL_BLOCK *)a1, &KeyPath);
    v6 = KeyPath;
    if( KeyPath )
    {
      LOBYTE(v5) = a2;
      v2(v5, v9, 0i64, 0i64, a1, KeyPath);
      CmpFreeTransientPoolWithTag(v6, 0x624E4D43ui64);
    }
    KiUnstackDetachProcess(&ApcState, 0i64);
  }
}

Referenced by: