EtwpPsProvTraceThread

VOID __stdcall EtwpPsProvTraceThread(_ETHREAD *Thread, _INITIAL_TEB *InitialTeb, UINT8 Create){
  _DWORD *CurrentThreadTeb; 
  _EWOW64PROCESS *WoW64Process; 
  int v8; 
  unsigned __int16 Machine; 
  ULONG v10; 
  _DWORD *Teb; 
  _EWOW64PROCESS *v12; 
  int v13; 
  unsigned __int16 v14; 
  _QWORD *v15; 
  int v16; 
  int UniqueProcess; 
  int UniqueThread; 
  _ETHREAD *v19; 
  __int64 v20; 
  __int64 v21; 
  void *Win32StartAddress; 
  volatile unsigned __int64 CycleTime; 
  PCEVENT_DESCRIPTOR EventDescriptor; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  int *p_UniqueThread; 
  int v27; 
  int v28; 
  void **p_StackBase; 
  int v30; 
  int v31; 
  void *volatile *p_StackLimit; 
  int v33; 
  int v34; 
  __int64 *v35; 
  int v36; 
  int v37; 
  __int64 *v38; 
  int v39; 
  int v40; 
  void **v41; 
  int v42; 
  int v43; 
  void **p_Win32StartAddress; 
  int v45; 
  int v46; 
  void **p_Teb; 
  int v48; 
  int v49; 
  int *v50; 
  int v51; 
  int v52; 
  volatile unsigned __int64 *p_CycleTime; 
  int v54; 
  int v55; 

  v19 = Thread;
  CycleTime = 0i64;
  v20 = 0i64;
  v21 = 0i64;
  v16 = 0;
  if( Create )
  {
    EventDescriptor = &ThreadStart;
    CurrentThreadTeb = PsGetCurrentThreadTeb();
    if( CurrentThreadTeb )
    {
      WoW64Process = KeGetCurrentThread()->Process->WoW64Process;
      if( WoW64Process && ((Machine = WoW64Process->Machine, Machine == 332) || Machine == 452) )
        v8 = CurrentThreadTeb[3032];
      else
        v8 = CurrentThreadTeb[1480];
      v16 = v8;
    }
  }
  else
  {
    EventDescriptor = (PCEVENT_DESCRIPTOR)ThreadStop;
    Teb = Thread->Tcb.Teb;
    if( Teb )
    {
      v12 = KeGetCurrentThread()->Process->WoW64Process;
      if( v12 && ((v14 = v12->Machine, v14 == 332) || v14 == 452) )
        v13 = Teb[3032];
      else
        v13 = Teb[1480];
      v16 = v13;
    }
  }
  UniqueProcess = (int)Thread->Cid.UniqueProcess;
  UserData.Ptr = (unsigned __int64)&UniqueProcess;
  UserData.Size = 4;
  UserData.Reserved = 0;
  UniqueThread = (int)Thread->Cid.UniqueThread;
  p_UniqueThread = &UniqueThread;
  v27 = 4;
  v28 = 0;
  p_StackBase = &Thread->Tcb.StackBase;
  v30 = 8;
  v31 = 0;
  p_StackLimit = &Thread->Tcb.StackLimit;
  v33 = 8;
  v34 = 0;
  if( Create )
  {
    if( InitialTeb )
    {
      v20 = *((_QWORD *)InitialTeb + 2);
      v21 = *((_QWORD *)InitialTeb + 3);
    }
  }
  else
  {
    v15 = Thread->Tcb.Teb;
    if( v15 )
    {
      v20 = v15[1];
      v21 = v15[2];
    }
  }
  v35 = &v20;
  v36 = 8;
  v37 = 0;
  v38 = &v21;
  v39 = 8;
  v40 = 0;
  PsQueryThreadStartAddress(Thread, 1ui64);
  v41 = &Win32StartAddress;
  v42 = 8;
  v43 = 0;
  Win32StartAddress = Thread->Win32StartAddress;
  p_Win32StartAddress = &Win32StartAddress;
  v45 = 8;
  v46 = 0;
  p_Teb = &Thread->Tcb.Teb;
  v48 = 8;
  v49 = 0;
  v50 = &v16;
  v51 = 4;
  v52 = 0;
  v10 = 10;
  if( !Create )
  {
    CycleTime = Thread->Tcb.CycleTime;
    p_CycleTime = &CycleTime;
    v54 = 8;
    v55 = 0;
    v10 = 11;
  }
  EtwWrite(*(&ExBootDevicesRemovedEvent + 245), EventDescriptor, 0, v10, &UserData);
}

Referenced by: