EtwTraceWorkingSetSwap

BOOLEAN __fastcall EtwTraceWorkingSetSwap(_EPROCESS *Process, char a2, __int64 a3){
  UINT64 v3; 
  BOOLEAN result; 
  UINT64 v8; 
  __int64 *v9; 
  unsigned int ProcessId; 
  EVENT_DATA_DESCRIPTOR UserData; 
  __int64 v12; 
  int v13; 
  int v14; 
  __int64 v15; 
  int v16; 
  int v17; 
  __int64 v18; 
  int v19; 
  int v20; 
  __int64 v21; 
  int v22; 
  int v23; 
  __int64 v24; 
  int v25; 
  int v26; 
  v3 = EtwpMemoryProvRegHandle;
  result = EtwProviderEnabled(EtwpMemoryProvRegHandle, 0, 0x80ui64);
  if( result )
  {
    UserData.Reserved = 0;
    v14 = 0;
    ProcessId = (unsigned int)PsGetProcessId((PEPROCESS)Process);
    UserData.Size = 4;
    v8 = 2i64;
    UserData.Ptr = (unsigned __int64)&ProcessId;
    v13 = 4;
    if( (a2 & 2) != 0 )
    {
      v12 = a3;
      v9 = KERNEL_MEM_EVENT_WS_INSWAP_START;
      if( (a2 & 1) == 0 )
        v9 = (__int64 *)&KERNEL_MEM_EVENT_WS_OUTSWAP_START;
    }
    else
    {
      v12 = a3 + 32;
      if( (a2 & 1) != 0 )
      {
        v9 = KERNEL_MEM_EVENT_WS_INSWAP_STOP;
      }
      else
      {
        v17 = 0;
        v20 = 0;
        v9 = KERNEL_MEM_EVENT_WS_OUTSWAP_STOP;
        v23 = 0;
        v26 = 0;
        v18 = a3 + 8;
        v21 = a3 + 16;
        v24 = a3 + 24;
        v8 = 6i64;
        v15 = a3;
        v16 = 8;
        v19 = 8;
        v22 = 8;
        v25 = 8;
      }
    }
    return EtwWrite(v3, (EVENT_DESCRIPTOR *)v9, 0i64, v8, &UserData);
  }
  return result;
}

Referenced by: