EtwpPsProvTracePriority

VOID __stdcall EtwpPsProvTracePriority(_ETHREAD *Thread, UINT64 HookId, INT64 OldPriority, INT64 NewPriority){
  int v4; 
  int v5; 
  int v6; 
  __int64 *v7; 
  int UniqueProcess; 
  int UniqueThread; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  int *p_UniqueThread; 
  __int64 v12; 
  int *v13; 
  __int64 v14; 
  int *v15; 
  __int64 v16; 
  int v17; 
  int v18; 

  v18 = NewPriority;
  v17 = OldPriority;
  v4 = HookId - 1328;
  if( v4 )
  {
    v5 = v4 - 1;
    if( v5 )
    {
      v6 = v5 - 2;
      if( v6 )
      {
        if( v6 != 1 )
          return;
        v7 = ThreadIoPriorityChange;
      }
      else
      {
        v7 = ThreadPagePriorityChange;
      }
    }
    else
    {
      v7 = ThreadCpuBasePriorityChange;
    }
  }
  else
  {
    v7 = (__int64 *)&ThreadCpuPriorityChange;
  }
  UniqueProcess = (int)Thread->Cid.UniqueProcess;
  *(_QWORD *)&UserData.Size = 4i64;
  UserData.Ptr = (unsigned __int64)&UniqueProcess;
  UniqueThread = (int)Thread->Cid.UniqueThread;
  p_UniqueThread = &UniqueThread;
  v13 = &v17;
  v15 = &v18;
  v12 = 4i64;
  v14 = 1i64;
  v16 = 1i64;
  EtwWriteEx(*(&ExBootDevicesRemovedEvent + 245), (PCEVENT_DESCRIPTOR)v7, 0i64, 1u, 0, 0, 4u, &UserData);
}

Referenced by: