KsepDsEventPnpIrp
VOID __stdcall KsepDsEventPnpIrp(
DRIVER_OBJECT *DriverObject,
DEVICE_OBJECT *Fdo,
IRP *Irp,
UINT64 MinorCode,
INT64 Status){
UINT64 v5;
UINT64 UserDataCount;
struct _EVENT_DATA_DESCRIPTOR UserData;
DEVICE_OBJECT **v8;
int v9;
int v10;
IRP **v11;
int v12;
int v13;
int *v14;
int v15;
int v16;
INT64 *p_Status;
int v18;
int v19;
DRIVER_OBJECT *v20;
DEVICE_OBJECT *v21;
IRP *v22;
int v23;
v23 = MinorCode;
v22 = Irp;
v21 = Fdo;
v20 = DriverObject;
v5 = *(_QWORD *)KseEtwHandle;
if( *(_QWORD *)KseEtwHandle )
{
if( EtwEventEnabled(*(UINT64 *)KseEtwHandle, (EVENT_DESCRIPTOR *)&KseDsEventPnpIrp, (EVENT_DESCRIPTOR *)Irp) )
{
UserData.Reserved = 0;
v10 = 0;
v13 = 0;
v16 = 0;
v19 = 0;
UserData.Ptr = (unsigned __int64)&v20;
v8 = &v21;
v11 = &v22;
v14 = &v23;
UserData.Size = 8;
v9 = 8;
v12 = 8;
p_Status = &Status;
LODWORD(UserDataCount) = 5;
v15 = 4;
v18 = 4;
EtwWriteEx(v5, (EVENT_DESCRIPTOR *)&KseDsEventPnpIrp, 0i64, 0i64, 0i64, 0i64, UserDataCount, &UserData);
}
}
}Referenced by:
KseDsCallbackHookIrpPnpFunction