EtwpTraceSystemShutdown

INT64 __stdcall EtwpTraceSystemShutdown(){
  INT64 result; 
  int v1; 
  _LARGE_INTEGER CurrentTime; 
  _LARGE_INTEGER v3; 
  EVENT_DATA_DESCRIPTOR UserData; 
  struct _EVENT_DATA_DESCRIPTOR v5; 
  int *v6; 
  int v7; 
  int v8; 
  _LARGE_INTEGER *v9; 
  int v10; 
  int v11; 
  CurrentTime.QuadPart = 0i64;
  KeQuerySystemTimePrecise(&CurrentTime);
  if( (unsigned int)dword_140C02BB0 > 5 )
  {
    LOBYTE(result) = tlgKeywordOn((__int64)&dword_140C02BB0, 0x400000000000i64);
    if( (_BYTE)result )
    {
      v8 = 0;
      v11 = 0;
      v6 = &v1;
      v3 = CurrentTime;
      v7 = 4;
      v9 = &v3;
      v1 = 2;
      v10 = 8;
      LODWORD(result) = tlgWriteTransfer_EtwWriteTransfer(
                          (__int64)&dword_140C02BB0,
                          (unsigned __int8 *)byte_14002B7D0,
                          0i64,
                          0i64,
                          4u,
                          &v5);
    }
  }
  if( EtwKernelProvRegHandle )
  {
    UserData.Reserved = 0;
    UserData.Ptr = (unsigned __int64)&CurrentTime;
    UserData.Size = 8;
    LODWORD(result) = EtwWrite(EtwKernelProvRegHandle, (EVENT_DESCRIPTOR *)&KernelSystemStop, 0i64, 1ui64, &UserData);
  }
  return result;
}

Referenced by: