PopDiagTracePolicyInitiatePowerActionApiCall
INT16 __fastcall PopDiagTracePolicyInitiatePowerActionApiCall(INT64 a1, INT64 a2){
unsigned __int16 *v2;
INT16 result;
int v4;
INT16 v5;
EVENT_DATA_DESCRIPTOR UserData;
__int64 v7;
int v8;
int v9;
int *v10;
__int64 v11;
int *v12;
__int64 v13;
int v14;
int v15;
v15 = a2;
v14 = a1;
v2 = *(unsigned __int16 **)(PsGetCurrentThreadProcess() + 1472);
result = *v2 >> 1;
v5 = result;
if( PopDiagHandleRegistered )
{
*(_QWORD *)&UserData.Size = 2i64;
UserData.Ptr = (unsigned __int64)&v5;
v4 = *v2;
v7 = *((_QWORD *)v2 + 1);
v10 = &v14;
v12 = &v15;
v8 = v4;
v9 = 0;
v11 = 4i64;
v13 = 4i64;
return EtwWrite(
PopDiagHandle,
(EVENT_DESCRIPTOR *)&POP_ETW_EVENT_NTINITIATEPOWERACTION_API_CALL,
0i64,
4ui64,
&UserData);
}
return result;
}Referenced by:
NtInitiatePowerAction