EtwpWriteAppStateChange

VOID __stdcall EtwpWriteAppStateChange(_ETW_APPSTATE_CHANGE_INFO *StateChangeInfo){
  __int64 v1; 
  _EVENT_DATA_DESCRIPTOR v2; 
  __int64 v3; 
  int v4; 
  int v5; 

  if( *(&stru_140C00F40 + 1806) > 5u )
  {
    if( tlgKeywordOn((__int64)&stru_140C00F40 + 7224, 0x200000000001i64) )
    {
      v5 = 0;
      v3 = v1;
      v4 = 98;
      tlgWriteTransfer_EtwWriteTransfer(
        (__int64)&stru_140C00F40 + 7224,
        (unsigned __int8 *)&unk_14002BB68,
        0i64,
        0i64,
        3u,
        &v2);
    }
  }
}

Referenced by:

EtwTraceAppStateChange
EtwTraceProcess