PopDiagTraceSetThreadExecutionState

char __fastcall PopDiagTraceSetThreadExecutionState(__int64 a1, int a2, EVENT_DESCRIPTOR *a3){
  void **v3; 
  UINT64 v5; 
  unsigned __int16 *v6; 
  __int64 *v7; 
  int v8; 
  char *v9; 
  __int16 v11; 
  int v12; 
  int v13; 
  EVENT_DATA_DESCRIPTOR UserData; 
  __int16 *v15; 
  __int64 v16; 
  __int64 v17; 
  int v18; 
  int v19; 
  char v20; 
  void *retaddr; 
  int v22; 
  v3 = &retaddr;
  v22 = a2;
  if( PopDiagHandleRegistered )
  {
    v5 = PopDiagHandle;
    LOBYTE(v3) = EtwEventEnabled(PopDiagHandle, (EVENT_DESCRIPTOR *)&POP_ETW_EVENT_STES, a3);
    if( (_BYTE)v3 )
    {
      v12 = *(_DWORD *)(a1 + 1144);
      v13 = *(_DWORD *)(a1 + 1152);
      v6 = *(unsigned __int16 **)(*(_QWORD *)(a1 + 544) + 1472i64);
      v11 = *v6 >> 1;
      UserData.Ptr = (unsigned __int64)&v22;
      v15 = &v11;
      v7 = &v17;
      *(_QWORD *)&UserData.Size = 4i64;
      v16 = 2i64;
      v8 = *v6;
      if( (_WORD)v8 )
      {
        v17 = *((_QWORD *)v6 + 1);
        v7 = (__int64 *)&v20;
        v18 = v8;
        v19 = 0;
      }
      v7[1] = 4i64;
      *v7 = (__int64)&v12;
      v9 = (char *)(v7 + 2);
      *((_QWORD *)v9 + 1) = 4i64;
      *(_QWORD *)v9 = &v13;
      LOBYTE(v3) = EtwWrite(
                     v5,
                     (EVENT_DESCRIPTOR *)&POP_ETW_EVENT_STES,
                     0i64,
                     (v9 - (char *)&UserData + 16) >> 4,
                     &UserData);
    }
  }
  return(char)v3;
}

Referenced by:

NtSetThreadExecutionState