EtwpPsProvTraceThread

VOID __stdcall EtwpPsProvTraceThread(_ETHREAD *Thread, _INITIAL_TEB *InitialTeb, UINT8 Create){
  _DWORD *CurrentThreadTeb; 
  __int64 v7; 
  int v8; 
  __int16 v9; 
  UINT64 v10; 
  __int64 v11; 
  __int64 v12; 
  int v13; 
  __int16 v14; 
  __int64 v15; 
  int v16; 
  int v17; 
  int v18; 
  _ETHREAD *v19; 
  PVOID StackBase; 
  PVOID StackLimit; 
  __int64 v22; 
  __int64 v23; 
  PCEVENT_DESCRIPTOR EventDescriptor; 
  EVENT_DATA_DESCRIPTOR UserData; 
  int *v26; 
  int v27; 
  int v28; 
  __int64 v29; 
  int v30; 
  int v31; 
  __int64 v32; 
  int v33; 
  int v34; 
  PVOID *p_StackBase; 
  int v36; 
  int v37; 
  PVOID *p_StackLimit; 
  int v39; 
  int v40; 
  __int64 *v41; 
  int v42; 
  int v43; 
  __int64 *v44; 
  int v45; 
  int v46; 
  __int64 v47; 
  int v48; 
  int v49; 
  int *v50; 
  int v51; 
  int v52; 
  __int64 *v53; 
  int v54; 
  int v55; 
  v19 = Thread;
  v23 = 0i64;
  StackBase = 0i64;
  StackLimit = 0i64;
  v16 = 0;
  if( Create )
  {
    EventDescriptor = &ThreadStart;
    CurrentThreadTeb = PsGetCurrentThreadTeb();
    if( CurrentThreadTeb )
    {
      v7 = *(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 68) + 1408i64);
      if( v7 && ((v9 = *(_WORD *)(v7 + 8), v9 == 332) || v9 == 452) )
        v8 = CurrentThreadTeb[3032];
      else
        v8 = CurrentThreadTeb[1480];
      v16 = v8;
    }
  }
  else
  {
    EventDescriptor = (PCEVENT_DESCRIPTOR)ThreadStop;
    v11 = *((_QWORD *)Thread + 30);
    if( v11 )
    {
      v12 = *(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 68) + 1408i64);
      if( v12 && ((v14 = *(_WORD *)(v12 + 8), v14 == 332) || v14 == 452) )
        v13 = *(_DWORD *)(v11 + 12128);
      else
        v13 = *(_DWORD *)(v11 + 5920);
      v16 = v13;
    }
  }
  v17 = *((_DWORD *)Thread + 286);
  UserData.Ptr = (unsigned __int64)&v17;
  UserData.Size = 4;
  UserData.Reserved = 0;
  v18 = *((_DWORD *)Thread + 288);
  v26 = &v18;
  v27 = 4;
  v28 = 0;
  v29 = (__int64)Thread + 56;
  v30 = 8;
  v31 = 0;
  v32 = (__int64)Thread + 48;
  v33 = 8;
  v34 = 0;
  if( Create )
  {
    if( InitialTeb )
    {
      StackBase = InitialTeb->StackBase;
      StackLimit = InitialTeb->StackLimit;
    }
  }
  else
  {
    v15 = *((_QWORD *)Thread + 30);
    if( v15 )
    {
      StackBase = *(PVOID *)(v15 + 8);
      StackLimit = *(PVOID *)(v15 + 16);
    }
  }
  p_StackBase = &StackBase;
  v36 = 8;
  v37 = 0;
  p_StackLimit = &StackLimit;
  v39 = 8;
  v40 = 0;
  PsQueryThreadStartAddress((__int64)Thread, 1);
  v41 = &v22;
  v42 = 8;
  v43 = 0;
  v22 = *((_QWORD *)Thread + 154);
  v44 = &v22;
  v45 = 8;
  v46 = 0;
  v47 = (__int64)Thread + 240;
  v48 = 8;
  v49 = 0;
  v50 = &v16;
  v51 = 4;
  v52 = 0;
  v10 = 10i64;
  if( !Create )
  {
    v23 = *((_QWORD *)Thread + 9);
    v53 = &v23;
    v54 = 8;
    v55 = 0;
    v10 = 11i64;
  }
  EtwWrite(*(UINT64 *)EtwpPsProvRegHandle, (EVENT_DESCRIPTOR *)EventDescriptor, 0i64, v10, &UserData);
}

Referenced by: