KsepDsEventDriverUnload
VOID __stdcall KsepDsEventDriverUnload(_DRIVER_OBJECT *DriverObject, PVOID BaseAddress){
EVENT_DESCRIPTOR *v2;
UINT64 v3;
UINT64 UserDataCount;
EVENT_DATA_DESCRIPTOR UserData;
PVOID *v6;
int v7;
int v8;
_DRIVER_OBJECT *v9;
PVOID v10;
v10 = BaseAddress;
v9 = DriverObject;
v3 = *(_QWORD *)KseEtwHandle;
if( *(_QWORD *)KseEtwHandle )
{
if( EtwEventEnabled(*(UINT64 *)KseEtwHandle, (EVENT_DESCRIPTOR *)&KseDsEventDriverUnload, v2) )
{
UserData.Reserved = 0;
v8 = 0;
UserData.Ptr = (unsigned __int64)&v9;
UserData.Size = 8;
v6 = &v10;
v7 = 8;
LODWORD(UserDataCount) = 2;
EtwWriteEx(v3, (EVENT_DESCRIPTOR *)&KseDsEventDriverUnload, 0i64, 0i64, 0i64, 0i64, UserDataCount, &UserData);
}
}
}Referenced by:
KseDsCallbackHookDriverUnload
KseDsHookDriverUntargeted