EtwpTraceLostEvent

int __fastcall EtwpTraceLostEvent(_QWORD *a1, __int16 *a2, unsigned __int16 *a3, int a4){
  __int64 v4; 
  __int16 v6; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  int *v8; 
  __int64 v9; 
  __int16 *v10; 
  __int64 v11; 
  __int64 v12; 
  int v13; 
  int v14; 
  __int64 *v15; 
  __int64 v16; 
  int v17; 

  v17 = a4;
  v4 = *a1 - *(_QWORD *)&EventTracingProvGuid;
  if( *a1 == *(_QWORD *)&EventTracingProvGuid )
    v4 = a1[1] - *((_QWORD *)&EventTracingProvGuid + 1);
  if( v4 )
  {
    v6 = *a2;
    UserData.Ptr = (unsigned __int64)a1;
    *(_QWORD *)&UserData.Size = 16i64;
    v8 = &v17;
    v9 = 4i64;
    v10 = &v6;
    v11 = 2i64;
    v12 = *((_QWORD *)a3 + 1);
    v13 = *a3;
    v14 = 0;
    v15 = &EtwpNull;
    v16 = 2i64;
    LODWORD(v4) = EtwWriteEx(*(&ExBootDevicesRemovedEvent + 241), &ETW_EVENT_LOST_EVENT, 0i64, 1u, 0, 0, 5u, &UserData);
  }
  return v4;
}

Referenced by: