EtwpReserveWithPebsIndex
INT64 __fastcall EtwpReserveWithPebsIndex(UINT64 *a1, INT16 a2, INT64 a3, INT64 a4, INT64 *a5, INT16 a6){
__int16 v6;
INT64 result;
v6 = a3 + 24;
result = EtwpReserveTraceBuffer(a1, (unsigned int)(a3 + 24), a4, a5, a6);
if( result )
{
*(_QWORD *)(result + 8) = *a5;
*(_WORD *)(result + 4) = v6;
*(_WORD *)(result + 6) = a2;
*(_DWORD *)result = (unsigned __int8)a6 | 0xC0118000;
*(_QWORD *)(result + 16) = **((_QWORD **)KeGetCurrentPrcb() + 4244);
result += 24i64;
}
return result;
}Referenced by:
EtwpLogContextSwapEvent
EtwpLogKernelEvent