EtwpWriteAppStateChangeWithStats

VOID __stdcall EtwpWriteAppStateChangeWithStats(
        _EPROCESS *Process,
        _ETW_APPSTATE_CHANGE_INFO *StateChangeInfo,
        _ETW_APPSTATE_PROCESS_TERMINATE_METRICS *AggregateProcessTerminateMetrics){
  INT64 v3; 
  __int64 v4; 
  int v5; 
  UINT64 ProcessStartKey; 
  __int64 v7; 
  unsigned __int8 v8; 
  int v9; 
  __int64 v10; 
  __int64 v11; 
  char v12; 
  char v13; 
  char v14; 
  char v15; 
  int v16; 
  int v17; 
  int v18; 
  UINT64 v19; 
  __int64 v20; 
  _EVENT_DATA_DESCRIPTOR v21; 
  __int64 v22; 
  int v23; 
  int v24; 
  int *v25; 
  int v26; 
  int v27; 
  __int64 *v28; 
  int v29; 
  int v30; 
  int *v31; 
  int v32; 
  int v33; 
  char *v34; 
  int v35; 
  int v36; 
  char *v37; 
  int v38; 
  int v39; 
  char *v40; 
  int v41; 
  int v42; 
  char *v43; 
  int v44; 
  int v45; 
  __int64 v46; 
  int v47; 
  int v48; 
  int *v49; 
  int v50; 
  int v51; 
  __int64 *v52; 
  int v53; 
  int v54; 

  if( *(&stru_140C00F40 + 1806) > 5u )
  {
    if( tlgKeywordOn((__int64)&stru_140C00F40 + 7224, 0x200000000003i64) )
    {
      v5 = *(_DWORD *)(v3 + 1088);
      v24 = 0;
      v27 = 0;
      v16 = v5;
      v22 = v4;
      v25 = &v16;
      v23 = 98;
      v26 = 4;
      ProcessStartKey = PsGetProcessStartKey(v3);
      v8 = *(_BYTE *)(v7 + 2171);
      v30 = 0;
      v33 = 0;
      v36 = 0;
      v39 = 0;
      v42 = 0;
      v45 = 0;
      v48 = 0;
      v51 = 0;
      v19 = ProcessStartKey;
      v28 = (__int64 *)&v19;
      v17 = *(_DWORD *)(v7 + 2004);
      v31 = &v17;
      LOBYTE(ProcessStartKey) = (v9 - 3) & (*(_DWORD *)(v7 + 2172) >> 2);
      v29 = v9 + 4;
      v12 = ProcessStartKey;
      v34 = &v12;
      v35 = v9 - 3;
      v13 = v8 & 7;
      v37 = &v13;
      v14 = (v8 >> 3) & 7;
      v38 = v9 - 3;
      v40 = &v14;
      v43 = &v15;
      v18 = *(_DWORD *)(v7 + 1832);
      v49 = &v18;
      v10 = *(_QWORD *)(v7 + 2344);
      v54 = 0;
      v20 = v10 << 12;
      v52 = &v20;
      v41 = v9 - 3;
      v15 = (v9 - 3) & (v8 >> 6);
      v44 = v9 - 3;
      v53 = v9 + 4;
      v32 = v9;
      v46 = v11;
      v47 = 44;
      v50 = v9;
      tlgWriteTransfer_EtwWriteTransfer(
        (__int64)&stru_140C00F40 + 7224,
        (unsigned __int8 *)&dword_14002C0E4,
        0i64,
        0i64,
        0xDu,
        &v21);
    }
  }
}

Referenced by: