EtwpTraceIoInit

VOID __stdcall EtwpTraceIoInit(IRP *Irp){
  char v2; 
  INT16 a5; 
  __int64 v4; 
  INT64 ThreadServerSilo; 
  int v6; 
  INT64 a6; 
  IRP *v8; 
  int v9; 
  int v10; 
  EVENT_DATA_DESCRIPTOR a2; 
  v10 = 0;
  v2 = **((_BYTE **)Irp + 23);
  if( v2 == 3 )
  {
    a5 = 268;
  }
  else
  {
    a5 = 271;
    if( v2 != 9 )
      a5 = 269;
  }
  v4 = *((_QWORD *)Irp + 19);
  if( v4 )
  {
    ThreadServerSilo = PsGetThreadServerSilo(*((_QWORD *)Irp + 19));
    v8 = Irp;
    v6 = *(_DWORD *)(v4 + 1152);
  }
  else
  {
    ThreadServerSilo = 0i64;
    v8 = Irp;
    v6 = -1;
  }
  a2.Reserved = 0;
  v9 = v6;
  LODWORD(a6) = 22026499;
  a2.Ptr = (unsigned __int64)&v8;
  a2.Size = 12;
  EtwTraceSiloKernelEvent(ThreadServerSilo, &a2, 1u, 0x400ui64, a5, a6);
}

Referenced by: