EtwpInitializeRegistration

NTSTATUS __stdcall EtwpInitializeRegistration(){
  _UNICODE_STRING DestinationString; 
  _OBJECT_TYPE_INITIALIZER ObjectTypeInitializer; 

  DestinationString = 0i64;
  KiInitializeMutant((_KMUTANT *)((char *)&ExBootDevicesRemovedEvent + 1376), 0, 1u);
  *(&ExBootDevicesRemovedEvent + 170) = 0i64;
  *(&ExBootDevicesRemovedEvent + 169) = (char *)&ExBootDevicesRemovedEvent + 1344;
  *(&ExBootDevicesRemovedEvent + 168) = (char *)&ExBootDevicesRemovedEvent + 1344;
  memset(&ObjectTypeInitializer, 0i64, sizeof(ObjectTypeInitializer));
  ObjectTypeInitializer._bf_0 |= 0x18u;
  ObjectTypeInitializer.OpenProcedure = (int(__fastcall *)(_OB_OPEN_REASON, char, _EPROCESS *, void *, unsigned int *, unsigned int))EtwpOpenRealTimeConnectionObject;
  ObjectTypeInitializer.Length = 120;
  ObjectTypeInitializer.CloseProcedure = (void(__fastcall *)(_EPROCESS *, void *, unsigned __int64, unsigned __int64))EtwpCloseRegistrationObject;
  ObjectTypeInitializer.InvalidAttributes = 256;
  ObjectTypeInitializer.DeleteProcedure = (void(__fastcall *)(void *))EtwpDeleteRegistrationObject;
  ObjectTypeInitializer.GenericMapping = EtwpGenericMapping;
  ObjectTypeInitializer.ValidAccessMask = 2052;
  ObjectTypeInitializer.PoolType = NonPagedPoolNx;
  ObjectTypeInitializer.DefaultNonPagedPoolCharge = 112;
  RtlInitUnicodeString(&DestinationString, L"EtwRegistration");
  return ObCreateObjectType(&DestinationString, &ObjectTypeInitializer, 0i64, &EtwpRegistrationObjectType);
}

Referenced by: