EtwpTraceSystemShutdown

VOID __stdcall EtwpTraceSystemShutdown(){
  int v0; 
  _LARGE_INTEGER CurrentTime; 
  _LARGE_INTEGER v2; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  _EVENT_DATA_DESCRIPTOR v4; 
  int *v5; 
  int v6; 
  int v7; 
  _LARGE_INTEGER *v8; 
  int v9; 
  int v10; 

  CurrentTime.QuadPart = 0i64;
  KeQuerySystemTimePrecise(&CurrentTime);
  if( *(&stru_140C00F40 + 1820) > 5u && tlgKeywordOn((__int64)&stru_140C00F40 + 7280, 0x400000000000i64) )
  {
    v7 = 0;
    v10 = 0;
    v5 = &v0;
    v2 = CurrentTime;
    v6 = 4;
    v8 = &v2;
    v0 = 2;
    v9 = 8;
    tlgWriteTransfer_EtwWriteTransfer(
      (__int64)&stru_140C00F40 + 7280,
      (unsigned __int8 *)byte_14002B7D0,
      0i64,
      0i64,
      4u,
      &v4);
  }
  if( *(&ExBootDevicesRemovedEvent + 380) )
  {
    UserData.Reserved = 0;
    UserData.Ptr = (unsigned __int64)&CurrentTime;
    UserData.Size = 8;
    EtwWrite(*(&ExBootDevicesRemovedEvent + 380), &KernelSystemStop, 0, 1u, &UserData);
  }
}

Referenced by: