EtwTiLogSuspendResumeProcess

VOID __stdcall EtwTiLogSuspendResumeProcess(INT64 a1, INT64 a2, INT64 a3, INT64 a4){
  int v4; 
  REGHANDLE v7; 
  __int64 v8; 
  int v9; 
  int v10; 
  __int64 *v11; 
  int v12; 
  NTSTATUS v13; 
  int v14; 
  int v15; 
  int v16; 
  unsigned __int64 v17; 
  unsigned __int64 v18; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  __int64 v20[28]; 
  int v21; 

  if( (int)a1 >= 0 )
  {
    v21 = a1;
    v4 = a4;
    if( KeGetCurrentThread()->PreviousMode == 1 )
    {
      v7 = *(&ExBootDevicesRemovedEvent + 179);
      if( EtwProviderEnabled(*(&ExBootDevicesRemovedEvent + 179), 0, 0xC00000ui64) )
      {
        v8 = *(_QWORD *)(a2 + 544);
        if( v4 )
        {
          v9 = v4 - 1;
          if( v9 )
          {
            v10 = v9 - 1;
            if( v10 )
            {
              if( v10 != 1 )
                return;
              v11 = (__int64 *)&THREATINT_THAW_PROCESS;
            }
            else
            {
              v11 = THREATINT_FREEZE_PROCESS;
            }
          }
          else
          {
            v11 = THREATINT_RESUME_PROCESS;
          }
        }
        else
        {
          v11 = THREATINT_SUSPEND_PROCESS;
        }
        if( EtwEventEnabled(v7, (PCEVENT_DESCRIPTOR)v11) )
        {
          UserData.Reserved = 0;
          UserData.Ptr = (unsigned __int64)&v21;
          UserData.Size = 4;
          v12 = EtwpTiFillProcessIdentity(v20, v8, &v17);
          v13 = EtwpTiFillThreadIdentity((INT64)(&UserData + (unsigned int)(v12 + 1)), a2);
          v15 = EtwpTiFillProcessIdentity(&UserData.Ptr + 2 * (unsigned int)(v13 + v14), a3, &v18);
          EtwWrite(*(&ExBootDevicesRemovedEvent + 179), (PCEVENT_DESCRIPTOR)v11, 0, v15 + v16, &UserData);
        }
      }
    }
  }
}

Referenced by: