TtmiLogDeviceDepartureNotified

VOID __stdcall TtmiLogDeviceDepartureNotified(_TERMINAL_DEVICE_PROVIDER Provider, UINT64 Token, UINT8 DeviceFound){
  NTSTATUS ProcessSessionId; 
  UINT8 v7; 
  NTSTATUS v8; 
  _TERMINAL_DEVICE_PROVIDER v9; 
  UINT64 v10; 
  _EVENT_DATA_DESCRIPTOR v11; 
  int *v12; 
  int v13; 
  int v14; 
  _TERMINAL_DEVICE_PROVIDER *v15; 
  int v16; 
  int v17; 
  UINT64 *v18; 
  int v19; 
  int v20; 
  UINT8 *v21; 
  int v22; 
  int v23; 

  if( (unsigned int)dword_140D2C8E8 > 5 )
  {
    if( tlgKeywordOn((__int64)&dword_140D2C8E8, 1i64) )
    {
      ProcessSessionId = PsGetProcessSessionIdEx((INT64)KeGetCurrentThread()->ApcState.Process);
      v14 = 0;
      v17 = 0;
      v20 = 0;
      v23 = 0;
      v8 = ProcessSessionId;
      v12 = &v8;
      v15 = &v9;
      v18 = &v10;
      v21 = &v7;
      v13 = 4;
      v16 = 4;
      v9 = Provider;
      v10 = Token;
      v19 = 8;
      v7 = DeviceFound;
      v22 = 1;
      tlgWriteTransfer_EtwWriteTransfer(
        (__int64)&dword_140D2C8E8,
        (unsigned __int8 *)&dword_14002AEA9,
        0i64,
        0i64,
        6u,
        &v11);
    }
  }
}

Referenced by: