VOID __stdcall PspLogAuditTerminateRemoteProcessEvent(UINT64 TargetProcessId, INT64 ReturnCode){
_EVENT_DATA_DESCRIPTOR v2;
int *v3;
int v4;
int v5;
int v6;
int v7;
v7 = ReturnCode;
v6 = TargetProcessId;
v2.Ptr = (unsigned __int64)&v6;
v2.Reserved = 0;
v2.Size = 4;
v3 = &v7;
v5 = 0;
v4 = 4;
EtwWrite(*(&ExBootDevicesRemovedEvent + 379), &KERNEL_AUDIT_API_TERMINATEPROCESS, 0, 2u, &v2);
}