EtwTraceThreadWorkItem

VOID __stdcall EtwTraceThreadWorkItem(PVOID RoutineAddress, UINT16 HookId){
  UINT64 Flag; 
  PVOID v4; 
  EVENT_DATA_DESCRIPTOR EventData; 
  v4 = RoutineAddress;
  if( RoutineAddress != IopProcessWorkItem && !ExIsSafeWorkItem((__int64(__fastcall *)(_QWORD *))RoutineAddress) )
  {
    EventData.Reserved = 0;
    EventData.Ptr = (unsigned __int64)&v4;
    EventData.Size = 8;
    LODWORD(Flag) = 290461954;
    EtwTraceKernelEvent(&EventData, 1ui64, 0x48000000ui64, HookId, Flag);
  }
}

Referenced by: