EtwTracePageFault

INT64 __fastcall EtwTracePageFault(
        INT64 a1,
        INT64 a2,
        INT64 a3,
        INT64 a4,
        INT64 a5,
        INT64 a6,
        INT64 a7,
        INT64 a8,
        INT64 a9,
        INT64 a10,
        INT64 a11,
        INT64 a12,
        INT64 a13,
        INT64 a14,
        INT64 a15,
        INT64 a16,
        INT64 a17,
        UINT64 NodeNumber,
        INT64 a19,
        _MI_PARTITION *Partition,
        UINT64 a21){
  INT64 result; 
  CHAR v22; 
  INT16 v23; 
  _ETHREAD *CurrentThread; 
  INT64 ThreadServerSilo; 
  int v26; 
  INT64 v27; 
  INT64 v28; 
  UINT64 a2a; 
  INT64 SystemArgument1; 
  EVENT_DATA_DESCRIPTOR v31; 
  v22 = a3;
  switch( (_DWORD)a1 )
  {
    case 0x111:
      v23 = 523;
      break;
    case 0x110:
      v23 = 522;
      break;
    case 0x112:
      v23 = 524;
      break;
    case 0x114:
      v23 = 526;
      break;
    case 0x113:
      v23 = 525;
      break;
    case 0xC0000005:
      v23 = 527;
      break;
    default:
      return result;
  }
  SystemArgument1 = 0i64;
  a2a = a2;
  if( a4 )
    SystemArgument1 = *(_QWORD *)(a4 + 360);
  v31.Reserved = 0;
  v31.Ptr = (unsigned __int64)&a2a;
  v31.Size = 16;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  if( (*((_BYTE *)CurrentThread + 1304) & 0x10) != 0 )
  {
    ThreadServerSilo = PsGetThreadServerSilo((INT64)CurrentThread);
    LODWORD(v28) = 33554690;
    EtwTraceSiloKernelEvent(ThreadServerSilo, &v31, 1u, 0x1000ui64, v23, v28);
  }
  else
  {
    --*((_WORD *)CurrentThread + 243);
    *((_BYTE *)CurrentThread + 1304) |= 0x10u;
    v26 = (_BYTE)a3 != 0 ? 33558786 : 50338050;
    v27 = PsGetThreadServerSilo((INT64)CurrentThread);
    LODWORD(v28) = v26;
    EtwTraceSiloKernelEvent(v27, &v31, 1u, 0x1000ui64, v23, v28);
    *((_BYTE *)CurrentThread + 1304) &= ~0x10u;
    KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
    result = EtwpHostSiloState + 4548;
    if( EtwpHostSiloState != -4548 )
    {
      result = *(unsigned int *)result;
      if( (result & 0x1000) != 0 )
        EtwpCoverageSamplerPageFault(SystemArgument1, a2a, v22);
    }
  }
  return result;
}

Referenced by: