PnpTraceDeviceRemoveProcessVeto

VOID __stdcall PnpTraceDeviceRemoveProcessVeto(
        UNICODE_STRING *DeviceInstanceId,
        UNICODE_STRING *VetoedDeviceInstanceId,
        UNICODE_STRING *ProcessName){
  unsigned __int16 *v3; 
  unsigned __int16 *v4; 
  unsigned __int16 *v5; 
  struct _EVENT_DATA_DESCRIPTOR v6; 
  int *v7; 
  __int64 v8; 
  __int64 v9; 
  int v10[2]; 
  int *v11; 
  __int64 v12; 
  __int64 v13; 
  int v14[2]; 
  int *v15; 
  __int64 v16; 
  __int64 v17; 
  int v18[2]; 
  if( (unsigned int)dword_140C02DC0 > 5 )
  {
    if( tlgKeywordOn((__int64)&dword_140C02DC0, 0x400000000000i64) )
    {
      v8 = 2i64;
      v7 = v10;
      v9 = *((_QWORD *)v5 + 1);
      v10[0] = *v5;
      v11 = v14;
      v13 = *((_QWORD *)v4 + 1);
      v14[0] = *v4;
      v15 = v18;
      v17 = *((_QWORD *)v3 + 1);
      v18[0] = *v3;
      v10[1] = 0;
      v12 = 2i64;
      v14[1] = 0;
      v16 = 2i64;
      v18[1] = 0;
      tlgWriteTransfer_EtwWriteTransfer(
        (__int64)&dword_140C02DC0,
        (unsigned __int8 *)byte_140024739,
        0i64,
        0i64,
        8u,
        &v6);
    }
  }
}

Referenced by: