PopDiagTraceCsExitReason
NTSTATUS __stdcall PopDiagTraceCsExitReason(
PANSI_STRING DestinationString,
PCUNICODE_STRING SourceString,
BOOL AllocateDestinationString){
__int64 v4;
char *Buffer;
__int64 v6;
unsigned __int8 v7;
unsigned int v8;
int v9;
int Buffer_high;
EVENT_DATA_DESCRIPTOR *UserData;
int v12;
void *v13;
char v15;
char v16;
char v17;
char v18;
int Length_low;
int v20;
int v21;
BOOL v22;
int v23;
int v24;
unsigned int v25;
int v26;
int v27;
int v28;
int v29;
int v30;
int v31;
int v32;
int v33;
int v34;
int v35;
int v36;
BOOL v37;
int v38;
int v39;
unsigned int v40;
int v41;
int v42;
int v43;
int v44;
int v45;
int v46;
int v47;
__int64 v48;
char *v49;
__int64 v50;
char *v51;
char *v52;
__int64 v53;
__int64 v54;
__int64 v55;
char *v56;
char *v57;
__int64 v58;
char *v59;
__int64 v60;
struct _STRING v61;
__int64 v62;
UINT64 v63;
__int64 v64;
char *v65;
__int64 v66;
char *v67;
__int64 v68;
char *v69;
__int64 v70;
__int64 v71;
char *v72;
char *v73;
__int64 v74;
char *v75;
__int64 v76;
struct _STRING v77;
__int64 v78;
struct _EVENT_DATA_DESCRIPTOR v79;
UINT64 *v80;
__int64 v81;
int *v82;
__int64 v83;
__int64 *v84;
__int64 v85;
char **v86;
__int64 v87;
__int64 *v88;
__int64 v89;
char **v90;
__int64 v91;
__int64 *v92;
__int64 v93;
int *v94;
__int64 v95;
char *v96;
__int64 v97;
int *v98;
__int64 v99;
int *v100;
__int64 v101;
__int64 *v102;
__int64 v103;
__int64 *v104;
__int64 v105;
int *v106;
__int64 v107;
__int64 *v108;
__int64 v109;
char **v110;
__int64 v111;
int *v112;
__int64 v113;
int *v114;
__int64 v115;
char **v116;
__int64 v117;
int *v118;
__int64 v119;
int *v120;
__int64 v121;
int *v122;
__int64 v123;
int *v124;
__int64 v125;
int *v126;
__int64 v127;
int *v128;
__int64 v129;
__int64 *v130;
__int64 v131;
char **v132;
__int64 v133;
__int64 *v134;
__int64 v135;
struct _STRING *v136;
__int64 v137;
char **p_Buffer;
__int64 v139;
__int64 *v140;
__int64 v141;
char *v142;
__int64 v143;
char *v144;
__int64 v145;
PCUNICODE_STRING v146;
v146 = SourceString;
v4 = *(_QWORD *)&DestinationString[2].Length;
Buffer = DestinationString[5].Buffer;
v20 = *(_DWORD *)&DestinationString->Length;
v51 = DestinationString[2].Buffer;
v48 = *(_QWORD *)&DestinationString[3].Length;
v21 = (int)DestinationString[3].Buffer;
v50 = *(_QWORD *)&DestinationString[4].Length;
v49 = DestinationString[4].Buffer;
v54 = *(_QWORD *)&DestinationString[6].Length;
v57 = DestinationString[6].Buffer;
v58 = *(_QWORD *)&DestinationString[5].Length;
v6 = *(_QWORD *)&DestinationString[8].Length;
v7 = BYTE4(DestinationString[7].Buffer);
v55 = v6;
v15 = v7 >> 1;
v23 = *(_DWORD *)(&DestinationString[7].MaximumLength + 1);
v56 = DestinationString[9].Buffer;
v24 = v7 & 1;
v8 = BYTE5(DestinationString[7].Buffer);
LOBYTE(v6) = BYTE5(DestinationString[7].Buffer);
Length_low = 0;
v26 = v6 & 1;
v60 = *(_QWORD *)&DestinationString[14].Length;
v59 = DestinationString[14].Buffer;
v61 = DestinationString[15];
v62 = *(_QWORD *)&DestinationString[16].Length;
v32 = *(_DWORD *)(&DestinationString[11].MaximumLength + 1);
v33 = (int)DestinationString[11].Buffer;
v28 = (unsigned __int8)PopConsoleExternalDisplayConnected;
v27 = (unsigned __int8)PopLidOpened;
v34 = BYTE4(DestinationString[11].Buffer);
v29 = *(_DWORD *)&DestinationString[12].Length;
v30 = *(_DWORD *)(&DestinationString[12].MaximumLength + 1);
v31 = (int)DestinationString[13].Buffer;
v53 = v4;
v52 = Buffer;
v25 = (v8 >> 1) & 1;
if( !v4 )
{
v48 = 0i64;
Buffer = 0i64;
v51 = 0i64;
v50 = 0i64;
v49 = 0i64;
v52 = 0i64;
}
v9 = (int)DestinationString[16].Buffer;
Buffer_high = HIDWORD(DestinationString[16].Buffer);
UserData = (EVENT_DATA_DESCRIPTOR *)(Buffer != 0i64);
v12 = 0;
v22 = Buffer != 0i64;
if( PopDiagHandleRegistered )
{
LOBYTE(UserData) = EtwEventEnabled(
PopDiagHandle,
(EVENT_DESCRIPTOR *)&POP_ETW_EVENT_CS_EXIT_REASON,
(EVENT_DESCRIPTOR *)Buffer);
if( (_BYTE)UserData )
{
UserData = (EVENT_DATA_DESCRIPTOR *)ExAllocatePoolWithTag(PagedPool, 0x2E0ui64, 0x50455654ui64);
v13 = UserData;
if( UserData )
{
*(_QWORD *)&UserData->Size = 4i64;
UserData->Ptr = (unsigned __int64)&v20;
UserData[1].Ptr = (unsigned __int64)&v48;
*(_QWORD *)&UserData[1].Size = 8i64;
UserData[2].Ptr = (unsigned __int64)&v49;
*(_QWORD *)&UserData[2].Size = 8i64;
UserData[3].Ptr = (unsigned __int64)&v50;
*(_QWORD *)&UserData[3].Size = 8i64;
UserData[4].Ptr = (unsigned __int64)&v51;
*(_QWORD *)&UserData[4].Size = 8i64;
UserData[5].Ptr = (unsigned __int64)&v53;
*(_QWORD *)&UserData[5].Size = 8i64;
UserData[6].Ptr = (unsigned __int64)&v21;
*(_QWORD *)&UserData[6].Size = 4i64;
UserData[7].Ptr = (unsigned __int64)&v15;
*(_QWORD *)&UserData[7].Size = 1i64;
UserData[8].Ptr = (unsigned __int64)&v22;
*(_QWORD *)&UserData[8].Size = 4i64;
UserData[9].Ptr = (unsigned __int64)&v23;
*(_QWORD *)&UserData[9].Size = 4i64;
UserData[10].Ptr = (unsigned __int64)&v52;
*(_QWORD *)&UserData[10].Size = 8i64;
UserData[11].Ptr = (unsigned __int64)&v54;
*(_QWORD *)&UserData[11].Size = 8i64;
UserData[12].Ptr = (unsigned __int64)&v24;
*(_QWORD *)&UserData[12].Size = 4i64;
UserData[13].Ptr = (unsigned __int64)&v55;
*(_QWORD *)&UserData[13].Size = 8i64;
UserData[14].Ptr = (unsigned __int64)&v56;
*(_QWORD *)&UserData[14].Size = 8i64;
UserData[15].Ptr = (unsigned __int64)&v25;
*(_QWORD *)&UserData[15].Size = 4i64;
UserData[16].Ptr = (unsigned __int64)&v26;
*(_QWORD *)&UserData[16].Size = 4i64;
UserData[17].Ptr = (unsigned __int64)&v57;
*(_QWORD *)&UserData[17].Size = 8i64;
UserData[18].Ptr = (unsigned __int64)&v32;
*(_QWORD *)&UserData[18].Size = 4i64;
UserData[19].Ptr = (unsigned __int64)&v33;
*(_QWORD *)&UserData[19].Size = 4i64;
UserData[20].Ptr = (unsigned __int64)&v27;
*(_QWORD *)&UserData[20].Size = 4i64;
UserData[21].Ptr = (unsigned __int64)&v28;
*(_QWORD *)&UserData[21].Size = 4i64;
UserData[22].Ptr = (unsigned __int64)&v146;
*(_QWORD *)&UserData[22].Size = 1i64;
UserData[23].Ptr = (unsigned __int64)&v34;
*(_QWORD *)&UserData[23].Size = 4i64;
UserData[24].Ptr = (unsigned __int64)&v29;
*(_QWORD *)&UserData[24].Size = 4i64;
UserData[25].Ptr = (unsigned __int64)&v30;
*(_QWORD *)&UserData[25].Size = 4i64;
UserData[26].Ptr = (unsigned __int64)&PopWnfCsEnterScenarioId;
*(_QWORD *)&UserData[26].Size = 8i64;
*(_QWORD *)&UserData[27].Size = 4i64;
UserData[27].Ptr = 0xFFFFF780000002C4ui64;
*(_QWORD *)&UserData[28].Size = 4i64;
UserData[28].Ptr = (unsigned __int64)&v31;
*(_QWORD *)&UserData[29].Size = 8i64;
UserData[29].Ptr = (unsigned __int64)&v58;
UserData[30].Ptr = (unsigned __int64)&v59;
*(_QWORD *)&UserData[30].Size = 8i64;
UserData[31].Ptr = (unsigned __int64)&v60;
*(_QWORD *)&UserData[31].Size = 8i64;
UserData[32].Ptr = (unsigned __int64)&v61;
*(_QWORD *)&UserData[32].Size = 8i64;
UserData[33].Ptr = (unsigned __int64)&v61.Buffer;
*(_QWORD *)&UserData[33].Size = 8i64;
UserData[34].Ptr = (unsigned __int64)&v62;
*(_QWORD *)&UserData[34].Size = 8i64;
Length_low = LOBYTE(DestinationString[17].Length);
UserData[35].Ptr = (unsigned __int64)&Length_low;
*(_QWORD *)&UserData[35].Size = 4i64;
UserData[36].Ptr = (unsigned __int64)&DestinationString[18];
*(_QWORD *)&UserData[36].Size = 4i64;
UserData[37].Ptr = (unsigned __int64)(&DestinationString[18].MaximumLength + 1);
*(_QWORD *)&UserData[37].Size = 4i64;
UserData[38].Ptr = (unsigned __int64)&DestinationString[17].Buffer;
*(_QWORD *)&UserData[38].Size = 8i64;
UserData[39].Ptr = (unsigned __int64)&DestinationString[19].Buffer;
*(_QWORD *)&UserData[39].Size = 4i64;
UserData[40].Ptr = (unsigned __int64)&DestinationString[19].Buffer + 4;
*(_QWORD *)&UserData[40].Size = 4i64;
UserData[41].Ptr = (unsigned __int64)&DestinationString[19];
*(_QWORD *)&UserData[41].Size = 8i64;
UserData[42].Ptr = (unsigned __int64)&DestinationString[18].Buffer;
*(_QWORD *)&UserData[42].Size = 4i64;
UserData[43].Ptr = (unsigned __int64)&DestinationString[18].Buffer + 4;
*(_QWORD *)&UserData[43].Size = 4i64;
UserData[44].Ptr = (unsigned __int64)&DestinationString[20];
*(_QWORD *)&UserData[44].Size = 4i64;
UserData[45].Ptr = (unsigned __int64)(&DestinationString[20].MaximumLength + 1);
*(_QWORD *)&UserData[45].Size = 4i64;
EtwWrite(PopDiagHandle, (EVENT_DESCRIPTOR *)&POP_ETW_EVENT_CS_EXIT_REASON, 0i64, 0x2Eui64, UserData);
ExFreePoolWithTag(v13, 0x50455654u);
}
else
{
v12 = -1073741670;
}
}
}
if( (unsigned int)dword_140C021E8 > 5 )
{
LOBYTE(UserData) = tlgKeywordOn((__int64)&dword_140C021E8, 0x400000000000i64);
if( (_BYTE)UserData )
{
v63 = PopWnfCsEnterScenarioId;
v80 = &v63;
v35 = v20;
v82 = &v35;
v64 = v48;
v84 = &v64;
v65 = v49;
v86 = &v65;
v66 = v50;
v88 = &v66;
v67 = v51;
v90 = &v67;
v68 = v53;
v92 = &v68;
v36 = v21;
v94 = &v36;
v16 = v15;
v96 = &v16;
v37 = v22;
v98 = &v37;
v38 = v23;
v100 = &v38;
v69 = v52;
v102 = (__int64 *)&v69;
v70 = v54;
v104 = &v70;
v39 = v24;
v106 = &v39;
v71 = v55;
v108 = &v71;
v72 = v56;
v110 = &v72;
v81 = 8i64;
v83 = 4i64;
v85 = 8i64;
v87 = 8i64;
v89 = 8i64;
v91 = 8i64;
v93 = 8i64;
v95 = 4i64;
v97 = 1i64;
v99 = 4i64;
v101 = 4i64;
v103 = 8i64;
v105 = 8i64;
v107 = 4i64;
v109 = 8i64;
v111 = 8i64;
v40 = v25;
v112 = (int *)&v40;
v41 = v26;
v114 = &v41;
v73 = v57;
v116 = &v73;
v42 = v27;
v118 = &v42;
v43 = v28;
v120 = &v43;
v44 = v29;
v122 = &v44;
v45 = v30;
v124 = &v45;
v126 = &v46;
v47 = v31;
v128 = &v47;
v74 = v58;
v130 = &v74;
v75 = v59;
v132 = &v75;
v76 = v60;
v134 = &v76;
v77 = v61;
v136 = &v77;
p_Buffer = &v77.Buffer;
v78 = v62;
v140 = &v78;
v142 = &v17;
v144 = &v18;
v113 = 4i64;
v115 = 4i64;
v117 = 8i64;
v119 = 4i64;
v121 = 4i64;
v123 = 4i64;
v125 = 4i64;
v46 = v12;
v127 = 4i64;
v129 = 4i64;
v131 = 8i64;
v133 = 8i64;
v135 = 8i64;
v137 = 8i64;
v139 = 8i64;
v141 = 8i64;
v17 = v9;
v143 = 1i64;
v18 = Buffer_high;
v145 = 1i64;
LODWORD(UserData) = tlgWriteTransfer_EtwWriteTransfer(
(__int64)&dword_140C021E8,
(unsigned __int8 *)&word_14002787E,
0i64,
0i64,
0x23u,
&v79);
}
}
return(int)UserData;
}Referenced by:
PopCaptureSleepStudyStatistics