EtwTraceJobServerSiloMonitorCallback

UINT8 __fastcall EtwTraceJobServerSiloMonitorCallback(INT64 a1, _EJOB *a2, EVENT_DESCRIPTOR *a3, INT64 a4){
  int v6; 
  __int64 *v7; 
  UINT64 v8; 
  UINT8 result; 
  _EJOB *v10; 
  unsigned int v11; 
  unsigned __int64 Keyword; 
  __int64 v13; 
  unsigned int v14; 
  __int64 v15; 
  UINT64 UserDataCount; 
  UINT64 JobIdOut; 
  GUID GuidOut; 
  EVENT_DATA_DESCRIPTOR UserData; 
  UINT64 *p_JobIdOut; 
  int v21; 
  int v22; 
  int *v23; 
  int v24; 
  int v25; 
  int v26; 
  v26 = a4;
  LODWORD(JobIdOut) = 0;
  v6 = a1;
  GuidOut = 0i64;
  if( (_DWORD)a1 )
  {
    if( (_DWORD)a1 == 1 )
    {
      v7 = (__int64 *)&ServerSiloCreateCallbackStop;
    }
    else if( (_DWORD)a1 == 2 )
    {
      v7 = ServerSiloTerminateCallbackStart;
    }
    else
    {
      v7 = ServerSiloTerminateCallbackStop;
    }
  }
  else
  {
    v7 = ServerSiloCreateCallbackStart;
  }
  v8 = *(_QWORD *)EtwpPsProvRegHandle;
  result = EtwEventEnabled(*(UINT64 *)EtwpPsProvRegHandle, (EVENT_DESCRIPTOR *)v7, a3);
  if( result )
  {
    EtwpCopyJobGuidSafe(&GuidOut, a2);
    UserData.Reserved = 0;
    UserData.Ptr = (unsigned __int64)&GuidOut;
    UserData.Size = 16;
    EtwpCopyJobIdSafe(&JobIdOut, v10);
    v22 = 0;
    p_JobIdOut = &JobIdOut;
    v21 = 4;
    v11 = 2;
    if( v6 == 1 )
    {
      v25 = 0;
      v23 = &v26;
      v11 = 3;
      v24 = 4;
    }
    Keyword = a3->Keyword;
    v13 = v11;
    v14 = v11 + 1;
    v13 *= 2i64;
    *(&UserData.Reserved + 2 * v13) = 0;
    *(&UserData.Ptr + v13) = Keyword;
    *(&UserData.Size + 2 * v13) = a3->Id;
    v15 = 2i64 * v14;
    *(&UserData.Reserved + 2 * v15) = 0;
    *(&UserData.Ptr + v15) = (unsigned __int64)&EtwpNull;
    *(&UserData.Size + 2 * v15) = 2;
    LODWORD(UserDataCount) = v14 + 1;
    return EtwWriteEx(v8, (EVENT_DESCRIPTOR *)v7, 0i64, 0i64, 0i64, 0i64, UserDataCount, &UserData);
  }
  return result;
}

Referenced by: