EtwTraceThread

VOID __stdcall EtwTraceThread(_ETHREAD *Thread, _INITIAL_TEB *InitialTeb, UINT8 Create){
  unsigned int v6; 
  __int64 v7; 
  _DWORD *CurrentThreadTeb; 
  _EWOW64PROCESS *WoW64Process; 
  int v10; 
  unsigned __int16 Machine; 
  _UNICODE_STRING *ThreadName; 
  INT64 v13; 
  _EWOW64PROCESS *v14; 
  __int64 v15; 
  unsigned __int16 v16; 
  unsigned int Length; 
  INT64 v18; 
  INT16 v19; 
  int v20; 
  int v21[2]; 
  void *StackBase; 
  void *volatile StackLimit; 
  __int64 v24; 
  __int64 v25; 
  unsigned __int64 Mask; 
  void *Win32StartAddress; 
  void *Teb; 
  int v29; 
  char BasePriority; 
  char PagePriorityThread; 
  char IoPriorityThread; 
  char v33; 
  __int64 v34; 
  PGET_UPDATED_BUS_RESOURCE v35[2]; 
  __int64 *Buffer; 
  __int64 v37; 
  __int64 *v38; 
  __int64 v39; 

  v6 = 2;
  v34 = 0i64;
  v20 = 5249283;
  if( EtwpHostSiloState != -4516 && (*(_DWORD *)(EtwpHostSiloState + 4516) & 2) != 0 )
    EtwpPsProvTraceThread(Thread, InitialTeb, Create);
  v21[0] = (int)Thread->Cid.UniqueProcess;
  v21[1] = (int)Thread->Cid.UniqueThread;
  StackBase = Thread->Tcb.StackBase;
  StackLimit = Thread->Tcb.StackLimit;
  Mask = Thread->Tcb.Affinity.Mask;
  Win32StartAddress = Thread->Win32StartAddress;
  v24 = 0i64;
  v25 = 0i64;
  Teb = Thread->Tcb.Teb;
  v29 = 0;
  BasePriority = Thread->Tcb.BasePriority;
  PagePriorityThread = PsGetPagePriorityThread(Thread);
  IoPriorityThread = PsGetIoPriorityThread(Thread);
  v33 = 0;
  if( Create )
  {
    v19 = 1281;
    if( InitialTeb )
    {
      v24 = *((_QWORD *)InitialTeb + 2);
      v25 = *((_QWORD *)InitialTeb + 3);
    }
    CurrentThreadTeb = PsGetCurrentThreadTeb();
    if( CurrentThreadTeb )
    {
      WoW64Process = KeGetCurrentThread()->Process->WoW64Process;
      if( WoW64Process && ((Machine = WoW64Process->Machine, Machine == 332) || Machine == 452) )
        v10 = CurrentThreadTeb[3032];
      else
        v10 = CurrentThreadTeb[1480];
      v29 = v10;
    }
  }
  else
  {
    v19 = 1282;
    v20 = 72358147;
    if( v7 )
    {
      v14 = KeGetCurrentThread()->Process->WoW64Process;
      if( v14 && ((v16 = v14->Machine, v16 == 332) || v16 == 452) )
      {
        v29 = *(_DWORD *)(v7 + 12128);
        v24 = *(unsigned int *)(v7 + 8196);
        v15 = *(unsigned int *)(v7 + 8200);
      }
      else
      {
        v29 = *(_DWORD *)(v7 + 5920);
        v24 = *(_QWORD *)(v7 + 8);
        v15 = *(_QWORD *)(v7 + 16);
      }
      v25 = v15;
    }
  }
  v35[0] = (PGET_UPDATED_BUS_RESOURCE)v21;
  v35[1] = (PGET_UPDATED_BUS_RESOURCE)72;
  ThreadName = Thread->ThreadName;
  if( ThreadName && ThreadName->Buffer )
  {
    Length = 2048;
    if( ThreadName->Length < 0x800u )
      Length = ThreadName->Length;
    Buffer = (__int64 *)ThreadName->Buffer;
    v37 = Length;
    if( !Length || ThreadName->Buffer[((unsigned __int64)Length >> 1) - 1] )
    {
      v38 = &EtwpNull;
      v39 = 2i64;
      v6 = 3;
    }
  }
  else
  {
    Buffer = &EtwpNull;
    v37 = 2i64;
  }
  LODWORD(v13) = PsGetProcessServerSilo((INT64)Thread->Tcb.Process);
  LODWORD(v18) = v20;
  EtwTraceSiloKernelEvent(v13, v35, v6, 2ui64, v19, v18);
}

Referenced by: