TtmiLogCalloutStop

VOID __stdcall TtmiLogCalloutStop(
        _TERMINAL_DEVICE_PROVIDER Provider,
        UINT64 Token,
        UINT64 CalloutTag,
        INT64 Status,
        UINT64 Duration,
        INT64 a6){
  INT64 v6; 
  int v8; 
  unsigned __int8 *v10; 
  int *v11; 
  char *v12; 
  NTSTATUS v13; 
  _TERMINAL_DEVICE_PROVIDER v14; 
  int v15; 
  int v16; 
  NTSTATUS ProcessSessionId; 
  _TERMINAL_DEVICE_PROVIDER v18; 
  int v19; 
  int v20; 
  UINT64 v21; 
  INT64 v22; 
  UINT64 v23; 
  INT64 v24; 
  char v25; 
  NTSTATUS *v26; 
  __int64 v27; 
  _TERMINAL_DEVICE_PROVIDER *v28; 
  __int64 v29; 
  int *v30; 
  __int64 v31; 
  UINT64 *v32; 
  __int64 v33; 
  __int64 *v34; 
  __int64 v35; 
  int *v36; 
  __int64 v37[5]; 
  char v38; 
  NTSTATUS *p_ProcessSessionId; 
  __int64 v40; 
  _TERMINAL_DEVICE_PROVIDER *v41; 
  __int64 v42; 
  int *v43; 
  __int64 v44; 
  UINT64 *v45; 
  __int64 v46; 
  __int64 *v47; 
  __int64 v48; 
  int *v49; 
  __int64 v50[5]; 
  int v51; 

  v51 = Status;
  v6 = a6;
  v8 = Token;
  if( (unsigned __int64)a6 > 0x1312D00 )
  {
    if( (unsigned int)dword_140D2C8B0 > 5 && tlgKeywordOn((__int64)&dword_140D2C8B0, 0x400000000001i64) )
    {
      ProcessSessionId = PsGetProcessSessionIdEx((INT64)KeGetCurrentThread()->ApcState.Process);
      v10 = (unsigned __int8 *)byte_14002A9E3;
      v40 = 4i64;
      p_ProcessSessionId = &ProcessSessionId;
      v11 = &dword_140D2C8B0;
      v18 = Provider;
      v41 = &v18;
      v43 = &v19;
      v45 = &v23;
      v47 = v50;
      v49 = &v51;
      v20 = Duration;
      v50[1] = (__int64)&v20;
      v50[3] = (__int64)&v24;
      v12 = &v38;
      v42 = 4i64;
      v19 = v8;
      v44 = 4i64;
      v23 = CalloutTag;
      v46 = 8i64;
      v48 = 2i64;
      v50[0] = 4i64;
      v50[2] = 4i64;
      v24 = v6;
      v50[4] = 8i64;
      goto LABEL_8;
    }
  }
  else if( (unsigned int)dword_140D2C8E8 > 5 && tlgKeywordOn((__int64)&dword_140D2C8E8, 1i64) )
  {
    v13 = PsGetProcessSessionIdEx((INT64)KeGetCurrentThread()->ApcState.Process);
    v10 = (unsigned __int8 *)&unk_14002AE38;
    v27 = 4i64;
    v26 = &v13;
    v11 = &dword_140D2C8E8;
    v14 = Provider;
    v28 = &v14;
    v30 = &v15;
    v32 = &v21;
    v34 = v37;
    v36 = &v51;
    v16 = Duration;
    v37[1] = (__int64)&v16;
    v37[3] = (__int64)&v22;
    v12 = &v25;
    v29 = 4i64;
    v15 = v8;
    v31 = 4i64;
    v21 = CalloutTag;
    v33 = 8i64;
    v35 = 2i64;
    v37[0] = 4i64;
    v37[2] = 4i64;
    v22 = v6;
    v37[4] = 8i64;
LABEL_8:
    tlgWriteTransfer_EtwWriteTransfer((__int64)v11, v10, 0i64, 0i64, 0xAu, (PEVENT_DATA_DESCRIPTOR)v12);
  }
}

Referenced by: