_ETW_REG_ENTRY

//0x70 bytes (sizeof) struct _ETW_REG_ENTRY { struct _LIST_ENTRY RegList; //0x0 struct _LIST_ENTRY GroupRegList; //0x10 struct _ETW_GUID_ENTRY* GuidEntry; //0x20 struct _ETW_GUID_ENTRY* GroupEntry; //0x28 union { struct _ETW_REPLY_QUEUE* ReplyQueue; //0x30 struct _ETW_QUEUE_ENTRY* ReplySlot[4]; //0x30 struct { VOID* Caller; //0x30 ULONG SessionId; //0x38 }; }; union { struct _EPROCESS* Process; //0x50 VOID* CallbackContext; //0x50 }; VOID* Callback; //0x58 USHORT Index; //0x60 union { UCHAR Flags; //0x62 struct { UCHAR DbgKernelRegistration:1; //0x62 UCHAR DbgUserRegistration:1; //0x62 UCHAR DbgReplyRegistration:1; //0x62 UCHAR DbgClassicRegistration:1; //0x62 UCHAR DbgSessionSpaceRegistration:1; //0x62 UCHAR DbgModernRegistration:1; //0x62 UCHAR DbgClosed:1; //0x62 UCHAR DbgInserted:1; //0x62 }; }; UCHAR EnableMask; //0x63 UCHAR GroupEnableMask; //0x64 UCHAR UseDescriptorType; //0x65 struct _ETW_PROVIDER_TRAITS* Traits; //0x68 };