EtwTraceThreadWorkOnBehalfUpdate

VOID __stdcall EtwTraceThreadWorkOnBehalfUpdate(_ETHREAD *OldWorkOnBehalfThread, _ETHREAD *NewWorkOnBehalfThread){
  INT64 v2; 
  __int64 v3; 
  UINT64 v4; 
  __int64 v5; 
  int v6; 
  int v7; 
  UINT64 UserDataCount; 
  int v9; 
  int v10; 
  EVENT_DATA_DESCRIPTOR UserData; 
  int *v12; 
  __int64 v13; 
  if( *(_QWORD *)EtwpPsProvRegHandle
    && (EtwpLevelKeywordEnabled(*(_QWORD *)(*(_QWORD *)EtwpPsProvRegHandle + 32i64) + 96i64, 4u, 0x8000000000002000ui64)
     || *(_BYTE *)(v4 + 101) && EtwpLevelKeywordEnabled(*(_QWORD *)(v4 + 40) + 96i64, 4u, v2)) )
  {
    if( v3 )
      v6 = *(_DWORD *)(v3 + 1152);
    else
      v6 = 0;
    v9 = v6;
    UserData.Ptr = (unsigned __int64)&v9;
    *(_QWORD *)&UserData.Size = 4i64;
    if( v5 )
      v7 = *(_DWORD *)(v5 + 1152);
    else
      v7 = 0;
    v10 = v7;
    v13 = 4i64;
    v12 = &v10;
    LODWORD(UserDataCount) = 2;
    EtwWriteEx(v4, (EVENT_DESCRIPTOR *)&ThreadWorkOnBehalfUpdate, 0i64, 1ui64, 0i64, 0i64, UserDataCount, &UserData);
  }
}

Referenced by: