EtwTraceJobRemoveProcess

void __fastcall EtwTraceJobRemoveProcess(__int64 a1, int a2, int a3){
  int v3; 
  __int64 v4; 
  UINT64 Flag; 
  __int64 v6[2]; 
  int v7; 
  int v8; 
  int v9; 
  int v10; 
  EVENT_DATA_DESCRIPTOR EventData; 
  v6[0] = 0i64;
  v3 = 0;
  v6[1] = 0i64;
  if( a1 && (v4 = *(_QWORD *)(a1 + 1296), v3 = *(_DWORD *)(a1 + 1088), v4) )
    v7 = *(_DWORD *)(v4 + 1236);
  else
    v7 = 0;
  v8 = v3;
  v9 = a2;
  v10 = a3;
  EventData.Ptr = (unsigned __int64)v6;
  *(_QWORD *)&EventData.Size = 32i64;
  LODWORD(Flag) = 5249284;
  EtwTraceKernelEvent(&EventData, 1ui64, 0x80000ui64, 0x724u, Flag);
}

Referenced by: