PopRecordPoIrpBlackboxInformation

VOID __stdcall PopRecordPoIrpBlackboxInformation(){
  UINT64 v0; 
  __int64 *v1; 
  int v2; 
  VOID **v3; 
  UINT64 v4; 
  unsigned __int64 v5; 
  __int64 v6; 
  VOID **PoolWithTag; 
  VOID *v8; 
  _DWORD *v9; 
  __int64 *i; 
  __int64 v11; 
  UINT64 v12; 
  __int64 v13; 
  UINT64 OutputBufferLength; 
  _KLOCK_QUEUE_HANDLE LockHandle; 
  __int64 InputBuffer; 
  __int128 InputBuffer_8; 
  __int128 v18; 
  __int16 DriverName[64]; 

  InputBuffer_8 = 0i64;
  InputBuffer = 0i64;
  v18 = 0i64;
  *(_OWORD *)&LockHandle.LockQueue.Lock = 0i64;
  KeAcquireInStackQueuedSpinLock((PKSPIN_LOCK)&stru_140C23628 + 121, (PKLOCK_QUEUE_HANDLE)&LockHandle.LockQueue.Lock);
  v1 = (__int64 *)*(&stru_140C23628 + 119);
  v2 = 0;
  v3 = 0i64;
  v4 = 64i64;
  if( (_UNKNOWN *)*(&stru_140C23628 + 119) == (_UNKNOWN *)((char *)&stru_140C23628 + 952) )
    goto LABEL_22;
  do
  {
    if( *((_BYTE *)v1 + 196) )
    {
      v5 = 24i64;
      if( PopDiagGetDriverName((_DEVICE_OBJECT *)v1[4], (WCHAR *)DriverName, v0) >= 0 )
      {
        v6 = -1i64;
        do
          ++v6;
        while( DriverName[v6] );
        v5 = 2 * v6 + 26;
        if( v5 < 0x18 )
          goto LABEL_22;
      }
      ++v2;
      if( v4 + v5 < v4 )
        goto LABEL_22;
      v4 += v5;
    }
    v1 = (__int64 *)*v1;
  }
  while( v1 != (__int64 *)((char *)&stru_140C23628 + 952) );
  if( !v2 )
  {
LABEL_22:
    v4 = 0i64;
  }
  else
  {
    PoolWithTag = ExAllocatePoolWithTag(0x200ui64, v4, 1111641936i64);
    v3 = PoolWithTag;
    if( PoolWithTag )
    {
      memset(PoolWithTag, 0i64, v4);
      *((_DWORD *)v3 + 2) = v2;
      v3[3] = (char *)&PopIrpWorkerControlEvent + 128;
      v8 = (VOID *)*(&WheapDeferredInternalLogsEventLock + 337);
      v3[2] = (char *)&stru_140C23628 + 952;
      v9 = v3 + 5;
      v3[4] = v8;
      *((_DWORD *)v3 + 1) = 1;
      *(_DWORD *)v3 = v4;
      for( i = (__int64 *)*(&stru_140C23628 + 119); i != (__int64 *)((char *)&stru_140C23628 + 952); i = (__int64 *)*i )
      {
        if( *((_BYTE *)i + 196) )
        {
          v9[2] = *((unsigned __int8 *)i + 184);
          v9[3] = *((_DWORD *)i + 47);
          v9[4] = *((_DWORD *)i + 48);
          v11 = 24i64;
          v9[1] = (KiQueryUnbiasedInterruptTime(1u) - i[6]) / 0x2710;
          if( PopDiagGetDriverName((_DEVICE_OBJECT *)i[4], (WCHAR *)DriverName, v12) >= 0 )
          {
            v13 = -1i64;
            do
              ++v13;
            while( DriverName[v13] );
            v11 = 2 * v13 + 26;
            memmove(v9 + 5, DriverName, 2 * v13);
            *((_WORD *)v9 + v13 + 10) = 0;
          }
          *v9 = v11;
          v9 = (_DWORD *)((char *)v9 + v11);
        }
      }
    }
  }
  KeReleaseInStackQueuedSpinLockFromDpcLevel((PKLOCK_QUEUE_HANDLE)&LockHandle.LockQueue.Lock);
  __writecr8((unsigned __int8)InputBuffer);
  if( v4 )
  {
    *(_QWORD *)&v18 = 0i64;
    *((_QWORD *)&v18 + 1) = 4i64;
    *(_QWORD *)&InputBuffer_8 = v3;
    *((_QWORD *)&InputBuffer_8 + 1) = (unsigned int)v4;
    LODWORD(OutputBufferLength) = 0;
    NtPowerInformation(
      PowerInformationLevelMaximum|SystemPowerCapabilities,
      &InputBuffer_8,
      0x20ui64,
      0i64,
      OutputBufferLength);
  }
  if( v3 )
    ExFreePoolWithTag(v3, 0x42424F50u);
}

Referenced by: