EtwTiLogSuspendResumeThread

VOID __fastcall EtwTiLogSuspendResumeThread(INT64 a1, INT64 a2, INT64 r8_0, CHAR a4){
  UINT64 v7; 
  EVENT_DESCRIPTOR *v8; 
  INT64 v9; 
  EVENT_DESCRIPTOR *v10; 
  int v11; 
  int v12; 
  int v13; 
  int v14; 
  int v15; 
  int v16; 
  int v17; 
  UINT64 a3; 
  UINT64 v19; 
  EVENT_DATA_DESCRIPTOR UserData; 
  __int64 v21[32]; 
  int v22; 
  if( (int)a1 >= 0 )
  {
    v22 = a1;
    if( *((_BYTE *)KeGetCurrentThread() + 562) == 1 )
    {
      v7 = EtwThreatIntProvRegHandle;
      if( EtwProviderEnabled(EtwThreatIntProvRegHandle, 0, 0x300000ui64) )
      {
        v9 = *(_QWORD *)(a2 + 544);
        v10 = (EVENT_DESCRIPTOR *)THREATINT_SUSPEND_THREAD;
        if( !a4 )
          v10 = (EVENT_DESCRIPTOR *)&THREATINT_RESUME_THREAD;
        if( EtwEventEnabled(v7, v10, v8) )
        {
          UserData.Reserved = 0;
          UserData.Ptr = (unsigned __int64)&v22;
          UserData.Size = 4;
          v11 = EtwpTiFillProcessIdentity(v21, v9, &a3);
          v12 = EtwpTiFillThreadIdentity((INT64)(&UserData + (unsigned int)(v11 + 1)), a2);
          v14 = EtwpTiFillProcessIdentity(&UserData.Ptr + 2 * (unsigned int)(v12 + v13), *(_QWORD *)(r8_0 + 544), &v19);
          v16 = EtwpTiFillThreadIdentity((INT64)(&UserData + (unsigned int)(v14 + v15)), r8_0);
          EtwWrite(EtwThreatIntProvRegHandle, v10, 0i64, (unsigned int)(v16 + v17), &UserData);
        }
      }
    }
  }
}

Referenced by: