EtwTracePageFault

VOID __stdcall EtwTracePageFault(INT64 Status, VOID *VirtualAddress, CHAR PreviousMode, VOID *TrapFrame){
  INT16 v5; 
  _ETHREAD *CurrentThread; 
  INT64 v7; 
  int v8; 
  INT64 v9; 
  INT64 v10; 
  UINT64 a2; 
  VOID *SystemArgument1; 
  PGET_UPDATED_BUS_RESOURCE p_a2; 
  int v14; 
  int v15; 

  switch( (_DWORD)Status )
  {
    case 0x111:
      v5 = 523;
      break;
    case 0x110:
      v5 = 522;
      break;
    case 0x112:
      v5 = 524;
      break;
    case 0x114:
      v5 = 526;
      break;
    case 0x113:
      v5 = 525;
      break;
    case 0xC0000005:
      v5 = 527;
      break;
    default:
      return;
  }
  SystemArgument1 = 0i64;
  a2 = (UINT64)VirtualAddress;
  if( TrapFrame )
    SystemArgument1 = (VOID *)*((_QWORD *)TrapFrame + 45);
  v15 = 0;
  p_a2 = (PGET_UPDATED_BUS_RESOURCE)&a2;
  v14 = 16;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  if( (CurrentThread->$84F33738BEE95ACDF5C5BF1C8FDC7C8C::_bf_0 & 0x10) != 0 )
  {
    LODWORD(v7) = PsGetThreadServerSilo((INT64)CurrentThread);
    LODWORD(v10) = 33554690;
    EtwTraceSiloKernelEvent(v7, &p_a2, 1ui64, 0x1000ui64, v5, v10);
  }
  else
  {
    --CurrentThread->Tcb.SpecialApcDisable;
    CurrentThread->$84F33738BEE95ACDF5C5BF1C8FDC7C8C::_bf_0 |= 0x10u;
    v8 = PreviousMode != 0 ? 33558786 : 50338050;
    LODWORD(v9) = PsGetThreadServerSilo((INT64)CurrentThread);
    LODWORD(v10) = v8;
    EtwTraceSiloKernelEvent(v9, &p_a2, 1ui64, 0x1000ui64, v5, v10);
    CurrentThread->$84F33738BEE95ACDF5C5BF1C8FDC7C8C::_bf_0 &= ~0x10u;
    KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
    if( EtwpHostSiloState != -4548 && (*(_DWORD *)(EtwpHostSiloState + 4548) & 0x1000) != 0 )
      EtwpCoverageSamplerPageFault(SystemArgument1, a2, PreviousMode);
  }
}

Referenced by: