EtwpPsProvTraceJob

VOID __stdcall EtwpPsProvTraceJob(_EJOB *Job, INT64 Status, UINT16 HookId){
  const _EVENT_DESCRIPTOR *v3; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  __int64 v5; 
  __int64 v6; 
  int *v7; 
  __int64 v8; 
  int v9; 

  v9 = Status;
  if( HookId == 1824 )
  {
    v3 = &JobStart;
  }
  else
  {
    if( HookId != 1825 )
      return;
    v3 = (const _EVENT_DESCRIPTOR *)JobTerminate;
  }
  *(_QWORD *)&UserData.Size = 16i64;
  UserData.Ptr = (unsigned __int64)Job + 1240;
  v6 = 4i64;
  v5 = (__int64)Job + 1236;
  v7 = &v9;
  v8 = 4i64;
  EtwWrite(*(&ExBootDevicesRemovedEvent + 245), v3, 0, 3u, &UserData);
}

Referenced by: