PpmEventTraceProcessorIdle

VOID __stdcall PpmEventTraceProcessorIdle(_KPRCB *Prcb){
  EVENT_DESCRIPTOR *v1; 
  __int64 v3; 
  int v4; 
  unsigned int v5; 
  unsigned int v6; 
  EVENT_DATA_DESCRIPTOR *PoolWithTag; 
  EVENT_DATA_DESCRIPTOR *UserData; 
  unsigned int v9; 
  EVENT_DATA_DESCRIPTOR *v10; 
  __int64 v11; 
  EVENT_DATA_DESCRIPTOR *v12; 
  const wchar_t *v13; 
  __int64 v14; 
  int v15; 
  __int16 v16; 
  unsigned int v17; 
  int v18; 
  if( PpmEtwRegistered && EtwEventEnabled(PpmEtwHandle, (EVENT_DESCRIPTOR *)&PPM_ETW_CURRENT_IDLE_RUNDOWN, v1) )
  {
    v3 = *((_QWORD *)Prcb + 4096);
    if( v3 )
    {
      v5 = *(_DWORD *)(v3 + 32);
      v17 = v5;
      v4 = *(_DWORD *)(v3 + 36);
    }
    else
    {
      v17 = 0;
      v4 = 0;
      v5 = 0;
    }
    v18 = v4;
    v6 = 2 * v5 + 4;
    PoolWithTag = (EVENT_DATA_DESCRIPTOR *)ExAllocatePoolWithTag(PagedPool, 16 * v6 + 37 * v5, 0x654D5050ui64);
    UserData = PoolWithTag;
    if( PoolWithTag )
    {
      memset((INT64)PoolWithTag, 0i64);
      v16 = *((unsigned __int8 *)Prcb + 208);
      v9 = 0;
      UserData->Reserved = 0;
      UserData[1].Reserved = 0;
      UserData[2].Reserved = 0;
      UserData[3].Reserved = 0;
      UserData->Ptr = (unsigned __int64)&v16;
      UserData[1].Ptr = (unsigned __int64)Prcb + 209;
      UserData[2].Ptr = (unsigned __int64)&v18;
      v10 = &UserData[v6];
      UserData[3].Ptr = (unsigned __int64)&v17;
      UserData->Size = 2;
      UserData[1].Size = 1;
      UserData[2].Size = 4;
      for( UserData[3].Size = 4; v9 < v17; UserData[v14].Reserved = 0 )
      {
        v11 = 248i64 * v9;
        v12 = &UserData[2 * v9 + 4];
        LODWORD(v10->Ptr) = *(_DWORD *)(v11 + v3 + 1000);
        HIDWORD(v10->Ptr) = *(_DWORD *)(v11 + v3 + 1004);
        LOBYTE(v10->Size) = *(_BYTE *)(v11 + v3 + 1056);
        *(unsigned int *)((char *)&v10->Size + 1) = *(unsigned __int8 *)(v11 + v3 + 1057);
        *(unsigned int *)((char *)&v10->Reserved + 1) = *(unsigned __int8 *)(v11 + v3 + 1058);
        *(_DWORD *)((char *)&v10[1].Ptr + 1) = *(unsigned __int8 *)(v11 + v3 + 1059);
        *(_DWORD *)((char *)&v10[1].Ptr + 5) = *(unsigned __int8 *)(v11 + v3 + 1060);
        *(unsigned int *)((char *)&v10[1].Size + 1) = *(unsigned __int8 *)(v11 + v3 + 1061);
        *(unsigned int *)((char *)&v10[1].Reserved + 1) = *(unsigned __int8 *)(v11 + v3 + 1062);
        *(_DWORD *)((char *)&v10[2].Ptr + 1) = *(unsigned __int8 *)(v11 + v3 + 1063);
        v12->Reserved = 0;
        v12->Ptr = (unsigned __int64)v10;
        v12->Size = 37;
        v13 = *(const wchar_t **)(v11 + v3 + 992);
        v14 = 2 * v9 + 5;
        if( v13 )
        {
          v15 = *(unsigned __int16 *)(v11 + v3 + 986);
        }
        else
        {
          v15 = 28;
          v13 = L"";
        }
        UserData[2 * v9 + 5].Ptr = (unsigned __int64)v13;
        v10 = (EVENT_DATA_DESCRIPTOR *)((char *)v10 + 37);
        UserData[2 * v9++ + 5].Size = v15;
      }
      EtwWrite(PpmEtwHandle, (EVENT_DESCRIPTOR *)&PPM_ETW_CURRENT_IDLE_RUNDOWN, 0i64, v6, UserData);
      ExFreePoolWithTag(UserData, 0x654D5050u);
    }
  }
}

Referenced by: