CmpLogReorganizeEvent

NTSTATUS __fastcall CmpLogReorganizeEvent(unsigned __int16 *a1, int a2, int a3){
  unsigned __int16 v3; 
  NTSTATUS result; 
  __int16 v5; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  __int64 v7; 
  int v8; 
  int v9; 
  int *v10; 
  __int64 v11; 
  int *v12; 
  __int64 v13; 
  int v14; 
  int v15; 

  v15 = a3;
  v14 = a2;
  if( *(&ExBootDevicesRemovedEvent + 380) )
  {
    v3 = *a1;
    v8 = *a1;
    v5 = v3 >> 1;
    UserData.Ptr = (unsigned __int64)&v5;
    v7 = *((_QWORD *)a1 + 1);
    v10 = &v14;
    v12 = &v15;
    *(_QWORD *)&UserData.Size = 2i64;
    v9 = 0;
    v11 = 4i64;
    v13 = 4i64;
    return EtwWrite(*(&ExBootDevicesRemovedEvent + 380), ®_EVENT_REORGANIZE, 0, 4u, &UserData);
  }
  return result;
}

Referenced by: