EtwpSysModuleRunDown

VOID __stdcall EtwpSysModuleRunDown(UINT64 LoggerId, UINT8 Start){
  __int16 v4; 
  UINT64 v5; 
  UINT64 v6; 
  int v7; 
  UINT64 v8; 
  UINT64 v9; 
  UINT64 Flag; 
  UINT64 Flaga; 
  UINT64 v12; 
  UINT64 v13; 
  PVOID HypercallPageVa; 
  __int64 v15[3]; 
  __int16 v16; 
  int v17; 
  __int16 v18; 
  INT64 result[5]; 
  __int128 v20; 
  EVENT_DATA_DESCRIPTOR EventData; 
  __int64 *v22; 
  __int64 v23; 
  v17 = 0;
  v18 = 0;
  memset((INT64)result, 0i64);
  HypercallPageVa = 0i64;
  if( !Start )
  {
    v5 = *(unsigned int *)LoggerId;
    v6 = *(_QWORD *)(LoggerId + 1080);
    EventData.Ptr = (unsigned __int64)&PsNtosImageBase;
    LODWORD(v12) = 4200450;
    LOWORD(Flag) = 5153;
    *(_QWORD *)&EventData.Size = 8i64;
    EtwpLogKernelEvent(&EventData, v6, v5, 1u, Flag, v12);
    HvlQueryConnection(&HypercallPageVa);
    if( !v7 )
    {
      v8 = *(unsigned int *)LoggerId;
      v9 = *(_QWORD *)(LoggerId + 1080);
      EventData.Ptr = (unsigned __int64)&HypercallPageVa;
      LODWORD(v13) = 4200450;
      LOWORD(Flaga) = 5154;
      *(_QWORD *)&EventData.Size = 8i64;
      EtwpLogKernelEvent(&EventData, v9, v8, 1u, Flaga, v13);
    }
  }
  v15[2] = LoggerId;
  v15[1] = (__int64)&EventData;
  v15[0] = (__int64)result;
  v4 = 5123;
  if( !Start )
    v4 = 5124;
  v16 = v4;
  *(_QWORD *)&EventData.Size = 56i64;
  EventData.Ptr = (unsigned __int64)result;
  v23 = 2i64;
  v22 = &EtwpNull;
  v20 = 0i64;
  MmEnumerateSystemImages((__int64(__fastcall *)(PVOID *, __int64))EtwpSystemImageEnumCallback, (__int64)v15);
}

Referenced by: