EtwTraceTimedEvent

VOID __stdcall EtwTraceTimedEvent(
        UINT16 HookId,
        UINT64 GroupMask,
        VOID *Data,
        UINT64 NumBytes,
        UINT64 Flag,
        _ETW_KERNEL_TRACE_TIMESTAMP *StartTime){
  unsigned int v7; 
  bool v8; 
  unsigned __int64 i; 
  __int64 v10; 
  __int64 v11; 
  _LARGE_INTEGER *v12; 
  int v13; 
  int v14; 
  VOID *v15; 
  int v16; 
  int v17; 

  v15 = Data;
  v16 = NumBytes;
  v17 = 0;
  v7 = *(_DWORD *)(EtwpHostSiloState + 4224);
  v8 = !_BitScanForward((unsigned int *)&Data, v7);
  for( i = (unsigned int)GroupMask; !v8; v8 = !_BitScanForward((unsigned int *)&Data, v7) )
  {
    v7 &= v7 - 1;
    v10 = 32i64 * (_QWORD)Data + EtwpHostSiloState + 4260;
    if( v10 )
    {
      if( ((unsigned int)i & *(_DWORD *)(v10 + 4 * (i >> 29)) & 0x1FFFFFFF) != 0 )
      {
        v11 = *(unsigned __int8 *)(EtwpHostSiloState + 2i64 * (_QWORD)Data + 4209);
        v14 = 0;
        v13 = 8;
        v12 = &StartTime->KernelTraceTimeStamp[v11 - 1];
        EtwpLogKernelEvent(
          (__int64)&v12,
          (_ETW_SILODRIVERSTATE *)EtwpHostSiloState,
          *(unsigned __int8 *)(EtwpHostSiloState + 2i64 * (_QWORD)Data + 4208),
          2u,
          HookId,
          Flag);
      }
    }
  }
}

Referenced by: