PopDiagTraceSetThreadExecutionState

VOID __stdcall PopDiagTraceSetThreadExecutionState(_ETHREAD *Thread, UINT64 NewFlags){
  REGHANDLE v3; 
  _OBJECT_NAME_INFORMATION *ImageFileName; 
  __int64 *v5; 
  int v6; 
  char *v7; 
  __int16 v8; 
  int UniqueProcess; 
  int UniqueThread; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  __int16 *v12; 
  __int64 v13; 
  __int64 v14; 
  int v15; 
  int v16; 
  char v17; 
  int v18; 

  v18 = NewFlags;
  if( PopDiagHandleRegistered )
  {
    v3 = PopDiagHandle;
    if( EtwEventEnabled(PopDiagHandle, &POP_ETW_EVENT_STES) )
    {
      UniqueProcess = (int)Thread->Cid.UniqueProcess;
      UniqueThread = (int)Thread->Cid.UniqueThread;
      ImageFileName = Thread->Tcb.Process->SeAuditProcessCreationInfo.ImageFileName;
      v8 = *(_WORD *)ImageFileName >> 1;
      UserData.Ptr = (unsigned __int64)&v18;
      v12 = &v8;
      v5 = &v14;
      *(_QWORD *)&UserData.Size = 4i64;
      v13 = 2i64;
      v6 = *(_WORD *)ImageFileName;
      if( (_WORD)v6 )
      {
        v14 = *((_QWORD *)ImageFileName + 1);
        v5 = (__int64 *)&v17;
        v15 = v6;
        v16 = 0;
      }
      v5[1] = 4i64;
      *v5 = (__int64)&UniqueProcess;
      v7 = (char *)(v5 + 2);
      *((_QWORD *)v7 + 1) = 4i64;
      *(_QWORD *)v7 = &UniqueThread;
      EtwWrite(v3, &POP_ETW_EVENT_STES, 0, (v7 - (char *)&UserData + 16) >> 4, &UserData);
    }
  }
}

Referenced by: