EtwpTraceImageUnload

VOID __fastcall EtwpTraceImageUnload(
        INT64 a1,
        INT64 rdx0,
        INT64 a3,
        INT64 a4,
        INT64 arg20,
        INT64 arg28,
        CHAR a7,
        CHAR a8,
        INT64 a9,
        INT64 a10){
  unsigned __int16 v11; 
  __int64 v13; 
  int v14; 
  UINT64 a5; 
  INT64 a6; 
  __int64 v17[2]; 
  int v18; 
  int v19; 
  int v20; 
  CHAR v21; 
  CHAR v22; 
  __int16 v23; 
  INT64 v24; 
  char v25[24]; 
  EVENT_DATA_DESCRIPTOR a2; 
  __int64 v27; 
  int v28; 
  int v29; 
  __int64 *v30; 
  __int64 v31; 
  if( a1 )
  {
    memset(v25, 0, sizeof(v25));
    v11 = *(_WORD *)a1;
    if( v11 )
    {
      v13 = *(_QWORD *)(a1 + 8);
      if( v13 )
      {
        if( rdx0 )
          v14 = *(_DWORD *)(rdx0 + 1088);
        else
          v14 = 0;
        v18 = v14;
        v19 = arg20;
        v20 = arg28;
        v21 = a7;
        v22 = a8;
        v17[0] = a3;
        v17[1] = a4;
        v23 = 0;
        v24 = a9;
        *(_OWORD *)v25 = 0i64;
        if( EtwpHostSiloState != -4516 && (*(_DWORD *)(EtwpHostSiloState + 4516) & 4) != 0 )
        {
          EtwpPsProvTraceImage((unsigned __int16 *)a1, (unsigned __int64)v17, 5122, a10);
          v13 = *(_QWORD *)(a1 + 8);
          v11 = *(_WORD *)a1;
        }
        *(_QWORD *)&a2.Size = 56i64;
        a2.Ptr = (unsigned __int64)v17;
        v28 = v11;
        v30 = &EtwpNull;
        v27 = v13;
        v29 = 0;
        v31 = 2i64;
        if( rdx0 )
        {
          LODWORD(a6) = (_DWORD)a10 != 0 ? 20977923 : 4200707;
          EtwTraceSiloKernelEvent(*(_QWORD *)(rdx0 + 2160), &a2, 3u, 4ui64, 5122, a6);
        }
        else
        {
          LODWORD(a5) = (_DWORD)a10 != 0 ? 20977923 : 4200707;
          EtwTraceKernelEvent(&a2, 3ui64, 4ui64, 0x1402u, a5);
        }
      }
    }
  }
}

Referenced by: