EtwTraceThread

VOID __fastcall EtwTraceThread(INT64 a1, INT64 rdx0, CHAR a3){
  UINT16 v6; 
  __int64 v7; 
  _DWORD *CurrentThreadTeb; 
  __int64 v9; 
  int v10; 
  __int16 v11; 
  unsigned __int16 *v12; 
  __int64 ProcessServerSilo; 
  __int64 v14; 
  __int64 v15; 
  __int16 v16; 
  unsigned int v17; 
  INT64 a6; 
  INT16 a5; 
  int v20; 
  int v21[2]; 
  __int64 v22; 
  __int64 v23; 
  __int64 v24; 
  __int64 v25; 
  __int64 v26; 
  __int64 v27; 
  __int64 v28; 
  int v29; 
  char v30; 
  char PagePriorityThread; 
  char IoPriorityThread; 
  char v33; 
  __int64 v34; 
  EVENT_DATA_DESCRIPTOR a2; 
  __int64 *v36; 
  __int64 v37; 
  __int64 *v38; 
  __int64 v39; 
  v6 = 2;
  v34 = 0i64;
  v20 = 5249283;
  if( EtwpHostSiloState != -4516 && (*(_DWORD *)(EtwpHostSiloState + 4516) & 2) != 0 )
    EtwpPsProvTraceThread((_ETHREAD *)a1, (_INITIAL_TEB *)rdx0, a3);
  v21[0] = *(_DWORD *)(a1 + 1144);
  v21[1] = *(_DWORD *)(a1 + 1152);
  v22 = *(_QWORD *)(a1 + 56);
  v23 = *(_QWORD *)(a1 + 48);
  v26 = *(_QWORD *)(a1 + 576);
  v27 = *(_QWORD *)(a1 + 1232);
  v24 = 0i64;
  v25 = 0i64;
  v28 = *(_QWORD *)(a1 + 240);
  v29 = 0;
  v30 = *(_BYTE *)(a1 + 563);
  PagePriorityThread = PsGetPagePriorityThread(a1);
  IoPriorityThread = PsGetIoPriorityThread(a1);
  v33 = 0;
  if( a3 )
  {
    a5 = 1281;
    if( rdx0 )
    {
      v24 = *(_QWORD *)(rdx0 + 16);
      v25 = *(_QWORD *)(rdx0 + 24);
    }
    CurrentThreadTeb = PsGetCurrentThreadTeb();
    if( CurrentThreadTeb )
    {
      v9 = *(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 68) + 1408i64);
      if( v9 && ((v11 = *(_WORD *)(v9 + 8), v11 == 332) || v11 == 452) )
        v10 = CurrentThreadTeb[3032];
      else
        v10 = CurrentThreadTeb[1480];
      v29 = v10;
    }
  }
  else
  {
    a5 = 1282;
    v20 = 72358147;
    if( v7 )
    {
      v14 = *(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 68) + 1408i64);
      if( v14 && ((v16 = *(_WORD *)(v14 + 8), v16 == 332) || v16 == 452) )
      {
        v29 = *(_DWORD *)(v7 + 12128);
        v24 = *(unsigned int *)(v7 + 8196);
        v15 = *(unsigned int *)(v7 + 8200);
      }
      else
      {
        v29 = *(_DWORD *)(v7 + 5920);
        v24 = *(_QWORD *)(v7 + 8);
        v15 = *(_QWORD *)(v7 + 16);
      }
      v25 = v15;
    }
  }
  a2.Ptr = (unsigned __int64)v21;
  *(_QWORD *)&a2.Size = 72i64;
  v12 = *(unsigned __int16 **)(a1 + 1552);
  if( v12 && *((_QWORD *)v12 + 1) )
  {
    v17 = 2048;
    if( *v12 < 0x800u )
      v17 = *v12;
    v36 = (__int64 *)*((_QWORD *)v12 + 1);
    v37 = v17;
    if( !v17 || *(_WORD *)(*((_QWORD *)v12 + 1) + 2 * ((unsigned __int64)v17 >> 1) - 2) )
    {
      v38 = &EtwpNull;
      v39 = 2i64;
      v6 = 3;
    }
  }
  else
  {
    v36 = &EtwpNull;
    v37 = 2i64;
  }
  ProcessServerSilo = PsGetProcessServerSilo(*(_QWORD *)(a1 + 544));
  LODWORD(a6) = v20;
  EtwTraceSiloKernelEvent(ProcessServerSilo, &a2, v6, 2ui64, a5, a6);
}

Referenced by: