EtwTraceReadyThread

VOID __stdcall EtwTraceReadyThread(_ETHREAD *Thread, UINT8 AdjustReason, INT8 AdjustIncrement, UINT64 Flags){
  int v5; 
  _EPROCESS *Process; 
  char v7; 
  VOID(__stdcall *Win32StartAddress)(VOID *); 
  _EPROCESS *v9; 
  INT64 v10; 
  int UniqueThread; 
  UINT8 v12; 
  INT8 v13; 
  char v14; 
  char v15; 
  PGET_UPDATED_BUS_RESOURCE p_UniqueThread; 
  int v17; 
  int v18; 

  UniqueThread = (int)Thread->Cid.UniqueThread;
  v5 = 5249538;
  v13 = AdjustIncrement;
  v12 = AdjustReason;
  v15 = 0;
  Process = Thread->Tcb.ApcState.Process;
  v14 = ~*((_BYTE *)&Thread->Tcb.MiscFlags + 6) & 2 | KeGetPcr()->Prcb._bf_0 & 1;
  v7 = (Process->Pcb.StackCount.Value & 7) != 0 ? 4 : 0;
  Win32StartAddress = (VOID(__stdcall *)(VOID *))Thread->Win32StartAddress;
  v14 = (v7 | v14 & 0xFB) ^ ((8 * Flags) ^ (v14 | v7)) & 8;
  if( (Flags & 2) != 0 || Win32StartAddress == KeSwapProcessOrStack || (char *)Win32StartAddress == (char *)EtwpLogger )
  {
    v5 = 5245442;
  }
  else if( EtwpHostSiloState != -4548 && (*(_DWORD *)(EtwpHostSiloState + 4552) & 0x200) != 0 )
  {
    EtwpCoverageSamplerReadyThread((INT64)Thread);
  }
  v9 = Thread->Tcb.Process;
  v18 = 0;
  p_UniqueThread = (PGET_UPDATED_BUS_RESOURCE)&UniqueThread;
  v17 = 8;
  LODWORD(v10) = v5;
  EtwTraceSiloKernelEvent((INT64)v9->ServerSilo, &p_UniqueThread, 1ui64, 0x20000200ui64, 1330, v10);
}

Referenced by: