EtwTiLogSuspendResumeProcess

VOID __fastcall EtwTiLogSuspendResumeProcess(INT64 a1, INT64 a2, INT64 r8_0, INT64 a4){
  int v4; 
  UINT64 v7; 
  EVENT_DESCRIPTOR *v8; 
  INT64 v9; 
  int v10; 
  int v11; 
  __int64 *v12; 
  int v13; 
  int v14; 
  int v15; 
  int v16; 
  int v17; 
  UINT64 a3; 
  UINT64 v19; 
  EVENT_DATA_DESCRIPTOR UserData; 
  __int64 v21[28]; 
  int v22; 
  if( (int)a1 >= 0 )
  {
    v22 = a1;
    v4 = a4;
    if( *((_BYTE *)KeGetCurrentThread() + 562) == 1 )
    {
      v7 = EtwThreatIntProvRegHandle;
      if( EtwProviderEnabled(EtwThreatIntProvRegHandle, 0, 0xC00000ui64) )
      {
        v9 = *(_QWORD *)(a2 + 544);
        if( v4 )
        {
          v10 = v4 - 1;
          if( v10 )
          {
            v11 = v10 - 1;
            if( v11 )
            {
              if( v11 != 1 )
                return;
              v12 = (__int64 *)&THREATINT_THAW_PROCESS;
            }
            else
            {
              v12 = THREATINT_FREEZE_PROCESS;
            }
          }
          else
          {
            v12 = THREATINT_RESUME_PROCESS;
          }
        }
        else
        {
          v12 = THREATINT_SUSPEND_PROCESS;
        }
        if( EtwEventEnabled(v7, (EVENT_DESCRIPTOR *)v12, v8) )
        {
          UserData.Reserved = 0;
          UserData.Ptr = (unsigned __int64)&v22;
          UserData.Size = 4;
          v13 = EtwpTiFillProcessIdentity(v21, v9, &a3);
          v14 = EtwpTiFillThreadIdentity((INT64)(&UserData + (unsigned int)(v13 + 1)), a2);
          v16 = EtwpTiFillProcessIdentity(&UserData.Ptr + 2 * (unsigned int)(v14 + v15), r8_0, &v19);
          EtwWrite(EtwThreatIntProvRegHandle, (EVENT_DESCRIPTOR *)v12, 0i64, (unsigned int)(v16 + v17), &UserData);
        }
      }
    }
  }
}

Referenced by: