EtwTraceJobRemoveProcess

VOID __stdcall EtwTraceJobRemoveProcess(_EPROCESS *Process, UINT64 RemovalFlags, INT64 ExitStatus){
  int UniqueProcessId; 
  _EJOB *volatile Job; 
  __int64 v5[2]; 
  int v6; 
  int v7; 
  int v8; 
  int v9; 
  __int64 v10[2]; 

  v5[0] = 0i64;
  UniqueProcessId = 0;
  v5[1] = 0i64;
  if( Process && (Job = Process->Job, UniqueProcessId = (int)Process->UniqueProcessId, Job) )
    v6 = *((_DWORD *)Job + 309);
  else
    v6 = 0;
  v7 = UniqueProcessId;
  v8 = RemovalFlags;
  v9 = ExitStatus;
  v10[0] = (__int64)v5;
  v10[1] = 32i64;
  EtwTraceKernelEvent((__int64)v10, 1u, 0x80000u, 0x724u, 0x501904u);
}

Referenced by: