PopDiagTraceSetThreadExecutionState
char __fastcall PopDiagTraceSetThreadExecutionState(__int64 a1, int a2, EVENT_DESCRIPTOR *a3){
void **v3;
UINT64 v5;
unsigned __int16 *v6;
__int64 *v7;
int v8;
char *v9;
__int16 v11;
int v12;
int v13;
EVENT_DATA_DESCRIPTOR UserData;
__int16 *v15;
__int64 v16;
__int64 v17;
int v18;
int v19;
char v20;
void *retaddr;
int v22;
v3 = &retaddr;
v22 = a2;
if( PopDiagHandleRegistered )
{
v5 = PopDiagHandle;
LOBYTE(v3) = EtwEventEnabled(PopDiagHandle, (EVENT_DESCRIPTOR *)&POP_ETW_EVENT_STES, a3);
if( (_BYTE)v3 )
{
v12 = *(_DWORD *)(a1 + 1144);
v13 = *(_DWORD *)(a1 + 1152);
v6 = *(unsigned __int16 **)(*(_QWORD *)(a1 + 544) + 1472i64);
v11 = *v6 >> 1;
UserData.Ptr = (unsigned __int64)&v22;
v15 = &v11;
v7 = &v17;
*(_QWORD *)&UserData.Size = 4i64;
v16 = 2i64;
v8 = *v6;
if( (_WORD)v8 )
{
v17 = *((_QWORD *)v6 + 1);
v7 = (__int64 *)&v20;
v18 = v8;
v19 = 0;
}
v7[1] = 4i64;
*v7 = (__int64)&v12;
v9 = (char *)(v7 + 2);
*((_QWORD *)v9 + 1) = 4i64;
*(_QWORD *)v9 = &v13;
LOBYTE(v3) = EtwWrite(
v5,
(EVENT_DESCRIPTOR *)&POP_ETW_EVENT_STES,
0i64,
(v9 - (char *)&UserData + 16) >> 4,
&UserData);
}
}
return(char)v3;
}Referenced by:
NtSetThreadExecutionState