EtwTraceWorkingSetInSwapStoreFail

VOID __stdcall EtwTraceWorkingSetInSwapStoreFail(PEPROCESS Process, INT64 FailStatus){
  REGHANDLE v2; 
  unsigned int ProcessId; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  int *v6; 
  int v7; 
  int v8; 
  int v9; 

  v9 = FailStatus;
  v2 = *(&ExBootDevicesRemovedEvent + 251);
  if( EtwProviderEnabled(*(&ExBootDevicesRemovedEvent + 251), 0, 0x80ui64) )
  {
    UserData.Reserved = 0;
    v8 = 0;
    ProcessId = (unsigned int)PsGetProcessId(Process);
    UserData.Size = 4;
    UserData.Ptr = (unsigned __int64)&ProcessId;
    v6 = &v9;
    v7 = 4;
    EtwWrite(v2, &KERNEL_MEM_EVENT_WS_INSWAP_STORE_FAIL, 0, 2u, &UserData);
  }
}

Referenced by: