CmpTraceHiveSaveStart
VOID __fastcall CmpTraceHiveSaveStart(_CM_KEY_CONTROL_BLOCK *KeyControlBlock){
_UNICODE_STRING *v2;
unsigned int Length;
__int16 v4;
_UNICODE_STRING *KeyPath;
_EVENT_DESCRIPTOR EventDescriptor;
_EVENT_DATA_DESCRIPTOR UserData;
__int16 *v8;
__int64 v9;
EventDescriptor = (_EVENT_DESCRIPTOR)REGISTRY_PERF_EVENT_HIVE_SAVE_START;
if( EtwEventEnabled(EtwpRegTraceHandle, &EventDescriptor) )
{
v4 = 0;
KeyPath = 0i64;
CmpConstructNameWithStatus(KeyControlBlock, &KeyPath);
v2 = KeyPath;
if( KeyPath )
{
Length = KeyPath->Length;
UserData.Ptr = (unsigned __int64)KeyPath->Buffer;
UserData.Size = Length;
v8 = &v4;
UserData.Reserved = 0;
v9 = 2i64;
EtwWrite(EtwpRegTraceHandle, &EventDescriptor, 0, 2u, &UserData);
CmpFreeTransientPoolWithTag(v2, 0x624E4D43ui64);
}
}
}Referenced by:
CmSaveKey