TtmiLogDeviceFromTerminalRemoved

VOID __stdcall TtmiLogDeviceFromTerminalRemoved(
        UINT64 TerminalId,
        _TERMINAL_DEVICE_PROVIDER Provider,
        UINT64 Token,
        UINT64 DeviceId){
  int v4; 
  int v7; 
  NTSTATUS ProcessSessionId; 
  NTSTATUS v9; 
  int v10; 
  _TERMINAL_DEVICE_PROVIDER v11; 
  int v12; 
  UINT64 v13; 
  _EVENT_DATA_DESCRIPTOR v14; 
  int *v15; 
  int v16; 
  int v17; 
  int *v18; 
  int v19; 
  int v20; 
  _TERMINAL_DEVICE_PROVIDER *v21; 
  int v22; 
  int v23; 
  UINT64 *v24; 
  int v25; 
  int v26; 
  int *v27; 
  int v28; 
  int v29; 

  v4 = DeviceId;
  v7 = TerminalId;
  if( (unsigned int)dword_140D2C8E8 > 5 )
  {
    if( tlgKeywordOn((__int64)&dword_140D2C8E8, 1i64) )
    {
      ProcessSessionId = PsGetProcessSessionIdEx((INT64)KeGetCurrentThread()->ApcState.Process);
      v17 = 0;
      v20 = 0;
      v23 = 0;
      v26 = 0;
      v29 = 0;
      v9 = ProcessSessionId;
      v15 = &v9;
      v18 = &v10;
      v21 = &v11;
      v24 = &v13;
      v27 = &v12;
      v16 = 4;
      v19 = 4;
      v22 = 4;
      v28 = 4;
      v10 = v7;
      v11 = Provider;
      v13 = Token;
      v25 = 8;
      v12 = v4;
      tlgWriteTransfer_EtwWriteTransfer(
        (__int64)&dword_140D2C8E8,
        (unsigned __int8 *)byte_14002A38F,
        0i64,
        0i64,
        7u,
        &v14);
    }
  }
}

Referenced by: