EtwTraceJobServerSiloMonitorCallback

BOOLEAN __fastcall EtwTraceJobServerSiloMonitorCallback(int a1, _EJOB *a2, unsigned __int16 *a3, int a4){
  __int64 *v7; 
  REGHANDLE v8; 
  BOOLEAN result; 
  _EJOB *v10; 
  unsigned int v11; 
  unsigned __int64 v12; 
  __int64 v13; 
  unsigned int v14; 
  __int64 v15; 
  UINT64 JobIdOut; 
  _GUID GuidOut; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  UINT64 *p_JobIdOut; 
  int v20; 
  int v21; 
  int *v22; 
  int v23; 
  int v24; 
  int v25; 

  v25 = a4;
  LODWORD(JobIdOut) = 0;
  GuidOut = 0i64;
  if( a1 )
  {
    if( a1 == 1 )
    {
      v7 = (__int64 *)&ServerSiloCreateCallbackStop;
    }
    else if( a1 == 2 )
    {
      v7 = ServerSiloTerminateCallbackStart;
    }
    else
    {
      v7 = ServerSiloTerminateCallbackStop;
    }
  }
  else
  {
    v7 = ServerSiloCreateCallbackStart;
  }
  v8 = *(&ExBootDevicesRemovedEvent + 245);
  result = EtwEventEnabled(*(&ExBootDevicesRemovedEvent + 245), (PCEVENT_DESCRIPTOR)v7);
  if( result )
  {
    EtwpCopyJobGuidSafe(&GuidOut, a2);
    UserData.Reserved = 0;
    UserData.Ptr = (unsigned __int64)&GuidOut;
    UserData.Size = 16;
    EtwpCopyJobIdSafe(&JobIdOut, v10);
    v21 = 0;
    p_JobIdOut = &JobIdOut;
    v20 = 4;
    v11 = 2;
    if( a1 == 1 )
    {
      v24 = 0;
      v22 = &v25;
      v11 = 3;
      v23 = 4;
    }
    v12 = *((_QWORD *)a3 + 1);
    v13 = v11;
    v14 = v11 + 1;
    v13 *= 2i64;
    *(&UserData.Reserved + 2 * v13) = 0;
    *(&UserData.Ptr + v13) = v12;
    *(&UserData.Size + 2 * v13) = *a3;
    v15 = 2i64 * v14;
    *(&UserData.Reserved + 2 * v15) = 0;
    *(&UserData.Ptr + v15) = (unsigned __int64)&EtwpNull;
    *(&UserData.Size + 2 * v15) = 2;
    return EtwWriteEx(v8, (PCEVENT_DESCRIPTOR)v7, 0i64, 0, 0, 0, v14 + 1, &UserData);
  }
  return result;
}

Referenced by: