EtwpEventWriteRegEntry

NTSTATUS __fastcall EtwpEventWriteRegEntry(__int64 a1, __int64 a2){
  bool v2; 
  __int64 v3; 
  unsigned __int64 v4; 
  __int64 v5; 
  char *v6; 
  int v8; 
  char v9; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  char *v11; 
  __int64 v12; 
  __int64 v13; 
  __int64 v14; 
  __int64 v15; 
  __int64 v16; 
  __int64 v17; 
  __int64 v18; 
  int *v19; 
  __int64 v20; 

  v2 = (*(_BYTE *)(a2 + 98) & 2) == 0;
  v8 = 0;
  if( !v2 )
  {
    v3 = *(_QWORD *)(a2 + 80);
    if( v3 )
      v8 = *(_DWORD *)(v3 + 1088);
  }
  v4 = *(_QWORD *)(a2 + 32) + 40i64;
  *(_QWORD *)&UserData.Size = 16i64;
  UserData.Ptr = v4;
  v5 = *(_QWORD *)(a2 + 40);
  v12 = 16i64;
  if( v5 )
    v6 = (char *)(v5 + 40);
  else
    v6 = &v9;
  v11 = v6;
  v13 = a2 + 98;
  v15 = a2 + 100;
  v14 = 2i64;
  v17 = a2 + 101;
  v16 = 1i64;
  v19 = &v8;
  v18 = 1i64;
  v20 = 4i64;
  return EtwWrite(*(&ExBootDevicesRemovedEvent + 241), &ETW_EVENT_REG_ENTRY_INFO, 0, 6u, &UserData);
}

Referenced by: