EtwTraceWorkingSetSwap

VOID __stdcall EtwTraceWorkingSetSwap(PEPROCESS Process, UINT64 Flags, VOID *EventParameters){
  REGHANDLE v3; 
  char v5; 
  ULONG v7; 
  __int64 *v8; 
  unsigned int ProcessId; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  VOID *v11; 
  int v12; 
  int v13; 
  VOID *v14; 
  int v15; 
  int v16; 
  __int64 v17; 
  int v18; 
  int v19; 
  __int64 v20; 
  int v21; 
  int v22; 
  __int64 v23; 
  int v24; 
  int v25; 

  v3 = *(&ExBootDevicesRemovedEvent + 251);
  v5 = Flags;
  if( EtwProviderEnabled(*(&ExBootDevicesRemovedEvent + 251), 0, 0x80ui64) )
  {
    UserData.Reserved = 0;
    v13 = 0;
    ProcessId = (unsigned int)PsGetProcessId(Process);
    UserData.Size = 4;
    v7 = 2;
    UserData.Ptr = (unsigned __int64)&ProcessId;
    v12 = 4;
    if( (v5 & 2) != 0 )
    {
      v11 = EventParameters;
      v8 = KERNEL_MEM_EVENT_WS_INSWAP_START;
      if( (v5 & 1) == 0 )
        v8 = (__int64 *)&KERNEL_MEM_EVENT_WS_OUTSWAP_START;
    }
    else
    {
      v11 = (char *)EventParameters + 32;
      if( (v5 & 1) != 0 )
      {
        v8 = KERNEL_MEM_EVENT_WS_INSWAP_STOP;
      }
      else
      {
        v16 = 0;
        v19 = 0;
        v8 = KERNEL_MEM_EVENT_WS_OUTSWAP_STOP;
        v22 = 0;
        v25 = 0;
        v17 = (__int64)EventParameters + 8;
        v20 = (__int64)EventParameters + 16;
        v23 = (__int64)EventParameters + 24;
        v7 = 6;
        v14 = EventParameters;
        v15 = 8;
        v18 = 8;
        v21 = 8;
        v24 = 8;
      }
    }
    EtwWrite(v3, (PCEVENT_DESCRIPTOR)v8, 0, v7, &UserData);
  }
}

Referenced by: