CmpLogHiveRundownEvent

void __fastcall CmpLogHiveRundownEvent(__int64 a1, PFN_WDFREGISTRYQUERYULONG *a2, unsigned int a3){
  __int64 v5; 
  unsigned int v7; 
  __int64 v8; 
  __int64 v9; 
  unsigned int v10; 
  int v11; 
  __int64 v12; 
  __int64 v13; 
  INT64 v14; 
  __int16 v15[8]; 
  PGET_UPDATED_BUS_RESOURCE v16; 
  __int64 v17[6]; 
  int v18; 
  int v19; 
  __int64 v20; 

  v20 = a1;
  v17[0] = 8i64;
  v15[0] = 0;
  v17[2] = 8i64;
  v5 = *(_QWORD *)(a1 + 1840);
  v17[4] = 4i64;
  v7 = 3;
  v8 = *(_QWORD *)(a1 + 1856);
  v16 = (PGET_UPDATED_BUS_RESOURCE)(a1 + 1792);
  v17[1] = (__int64)&v20;
  v17[3] = a1 + 4804;
  if( v5 )
  {
    v7 = 4;
    v18 = *(unsigned __int16 *)(a1 + 1832);
    v17[5] = v5;
    v19 = 0;
  }
  v9 = 2i64 * v7;
  v10 = v7 + 1;
  v17[v9 - 1] = (__int64)v15;
  v17[v9] = 2i64;
  if( v8 )
  {
    v11 = *(unsigned __int16 *)(a1 + 1848);
    v12 = 2i64 * v10++;
    v17[v12 - 1] = v8;
    LODWORD(v17[v12]) = v11;
    HIDWORD(v17[v12]) = 0;
  }
  v13 = 2i64 * v10;
  LODWORD(v14) = 4200450;
  v17[v13 - 1] = (__int64)v15;
  v17[v13] = 2i64;
  EtwTraceSiloDcEvent(&v16, v10 + 1, a2, a3, 2343, v14);
}

Referenced by: