EtwTraceJob

VOID __stdcall EtwTraceJob(_EJOB *Job, UINT64 Flags, INT64 Status, UINT16 HookId){
  int v5; 
  __int64 v6; 
  int v7; 
  _EJOB *v8; 
  unsigned int v9; 
  UINT64 Flag; 
  GUID GuidOut; 
  __int64 v12; 
  unsigned int v13; 
  EVENT_DATA_DESCRIPTOR EventData; 
  v12 = 0i64;
  v13 = 0;
  GuidOut = 0i64;
  EtwpCopyJobGuidSafe(&GuidOut, Job);
  if( v6 )
    LODWORD(v12) = *(_DWORD *)(v6 + 1236);
  else
    LODWORD(v12) = v5 & v12;
  EventData.Reserved = 0;
  HIDWORD(v12) = v7;
  v13 = v9;
  EventData.Ptr = (unsigned __int64)&GuidOut;
  EventData.Size = 28;
  if( v8 && EtwpHostSiloState != -4516 && (*(_DWORD *)(EtwpHostSiloState + 4516) & 0x80000) != 0 )
    EtwpPsProvTraceJob(v8, v9, HookId);
  LODWORD(Flag) = 5249284;
  EtwTraceKernelEvent(&EventData, 1ui64, 0x80000ui64, HookId, Flag);
}

Referenced by: