EtwpUpdateFileInfoDriverRegistration

NTSTATUS __stdcall EtwpUpdateFileInfoDriverRegistration(UINT64 Register){
  PKINTERRUPT_ROUTINE **v1; 
  PKINTERRUPT_ROUTINE *v2; 
  int v3; 
  INT64 v4; 
  _EJOB *v5; 
  _EJOB *v6; 
  int v7; 
  UINT64 ShareAccess; 
  UINT64 OpenOptions; 
  _UNICODE_STRING DestinationString; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int64 InputBuffer; 
  VOID *FileHandle; 

  InputBuffer = 0i64;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  v3 = Register;
  FileHandle = 0i64;
  IoStatusBlock = 0i64;
  DestinationString = 0i64;
  LODWORD(v4) = HalSystemVectorDispatchEntry(Register, v1, v2);
  LODWORD(v5) = PsAttachSiloToCurrentThread(v4);
  v6 = v5;
  RtlInitUnicodeString(&DestinationString, L"\\Device\\FileInfo");
  ObjectAttributes.RootDirectory = 0i64;
  LODWORD(OpenOptions) = 32;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 576;
  LODWORD(ShareAccess) = 7;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v7 = ZwOpenFile(&FileHandle, 0x120089ui64, &ObjectAttributes, &IoStatusBlock, ShareAccess, OpenOptions);
  if( v7 >= 0 )
  {
    LODWORD(InputBuffer) = 1;
    HIDWORD(InputBuffer) = v3;
    v7 = ZwDeviceIoControlFile((_HANDLE)FileHandle, 0, 0i64, 0i64, &IoStatusBlock, 0x220020u, &InputBuffer, 8u, 0i64, 0);
  }
  if( FileHandle )
    ZwClose((_HANDLE)FileHandle);
  PsDetachSiloFromCurrentThread(v6);
  return v7;
}

Referenced by: