EtwTiLogSuspendResumeThread

VOID __stdcall EtwTiLogSuspendResumeThread(INT64 a1, INT64 a2, INT64 a3, CHAR a4){
  REGHANDLE v7; 
  __int64 v8; 
  const _EVENT_DESCRIPTOR *v9; 
  int v10; 
  NTSTATUS v11; 
  int v12; 
  int v13; 
  int v14; 
  NTSTATUS v15; 
  int v16; 
  unsigned __int64 v17; 
  unsigned __int64 v18; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  __int64 v20[32]; 
  int v21; 

  if( (int)a1 >= 0 )
  {
    v21 = a1;
    if( KeGetCurrentThread()->PreviousMode == 1 )
    {
      v7 = *(&ExBootDevicesRemovedEvent + 179);
      if( EtwProviderEnabled(*(&ExBootDevicesRemovedEvent + 179), 0, 0x300000ui64) )
      {
        v8 = *(_QWORD *)(a2 + 544);
        v9 = (const _EVENT_DESCRIPTOR *)THREATINT_SUSPEND_THREAD;
        if( !a4 )
          v9 = &THREATINT_RESUME_THREAD;
        if( EtwEventEnabled(v7, v9) )
        {
          UserData.Reserved = 0;
          UserData.Ptr = (unsigned __int64)&v21;
          UserData.Size = 4;
          v10 = EtwpTiFillProcessIdentity(v20, v8, &v17);
          v11 = EtwpTiFillThreadIdentity((INT64)(&UserData + (unsigned int)(v10 + 1)), a2);
          v13 = EtwpTiFillProcessIdentity(&UserData.Ptr + 2 * (unsigned int)(v11 + v12), *(_QWORD *)(a3 + 544), &v18);
          v15 = EtwpTiFillThreadIdentity((INT64)(&UserData + (unsigned int)(v13 + v14)), a3);
          EtwWrite(*(&ExBootDevicesRemovedEvent + 179), v9, 0, v15 + v16, &UserData);
        }
      }
    }
  }
}

Referenced by: