WheapLogProcessTerminateEvent
NTSTATUS __fastcall WheapLogProcessTerminateEvent(INT64 a1, INT64 a2, INT64 a3){
UINT64 UserDataCount;
int v5;
EVENT_DATA_DESCRIPTOR UserData;
INT64 v7;
int v8;
int v9;
const WCHAR *v10;
__int64 v11;
v5 = a1;
UserData.Ptr = (unsigned __int64)&v5;
v7 = a2;
v10 = &ppszDestEnd;
v8 = a3;
LODWORD(UserDataCount) = 3;
v9 = 0;
*(_QWORD *)&UserData.Size = 4i64;
v11 = 2i64;
return EtwWriteEx(
WheapEtwHandle,
(EVENT_DESCRIPTOR *)&EVENT_WHEA_PROCESS_TERMINATE,
0i64,
0i64,
0i64,
0i64,
UserDataCount,
&UserData);
}Referenced by:
WheaTerminateProcess