EtwTraceFreezeThawProcess

VOID __stdcall EtwTraceFreezeThawProcess(_EPROCESS *Process, UINT8 Freeze){
  const _EVENT_DESCRIPTOR *v3; 
  int UniqueProcessId; 
  _EVENT_DATA_DESCRIPTOR v5; 
  _LARGE_INTEGER *p_CreateTime; 
  int v7; 
  int v8; 

  UniqueProcessId = (int)Process->UniqueProcessId;
  v5.Ptr = (unsigned __int64)&UniqueProcessId;
  v5.Reserved = 0;
  v5.Size = 4;
  p_CreateTime = &Process->CreateTime;
  v8 = 0;
  v7 = 8;
  if( EtwpHostSiloState != -4516 && (*(_DWORD *)(EtwpHostSiloState + 4524) & 2) != 0 )
  {
    v3 = (const _EVENT_DESCRIPTOR *)ProcessFreezeEvent;
    if( !Freeze )
      v3 = &ProcessThawEvent;
    EtwWrite(*(&ExBootDevicesRemovedEvent + 245), v3, 0, 2u, &v5);
  }
  EtwTraceKernelEvent((__int64)&v5, 1u, 0x40000002u, 805 - (Freeze != 0), 0x501902u);
}

Referenced by: