PpmEventTraceProcessorPerformance
void __fastcall PpmEventTraceProcessorPerformance(__int64 a1, __int64 a2, EVENT_DESCRIPTOR *a3){
unsigned int v3;
UINT64 v5;
__int64 v6;
_DWORD *v7;
unsigned int v8;
int v9;
_DWORD *v10;
__int16 v11;
int v12;
int v13;
int v14;
unsigned int v15;
int v16;
int v17;
int v18;
int v19;
BOOL v20;
int v21;
int v22;
unsigned int v23;
unsigned int v24;
int v25;
int v26;
int v27;
int v28;
EVENT_DATA_DESCRIPTOR UserData;
__int64 v30;
__int64 v31;
int *v32;
__int64 v33;
int *v34;
__int64 v35;
int *v36;
__int64 v37;
int *v38;
__int64 v39;
int *v40;
__int64 v41;
int *v42;
__int64 v43;
int *v44;
__int64 v45;
int *v46;
__int64 v47;
int *v48;
__int64 v49;
__int64 v50;
__int64 v51;
__int64 v52;
__int64 v53;
BOOL *v54;
__int64 v55;
int *v56;
__int64 v57;
int *v58;
__int64 v59;
int *v60;
__int64 v61;
int *v62;
__int64 v63;
__int64 v64;
__int64 v65;
int *v66;
__int64 v67;
int *v68;
__int64 v69;
int *v70;
__int64 v71;
v3 = 0;
if( PpmEtwRegistered )
{
v5 = PpmEtwHandle;
if( EtwEventEnabled(PpmEtwHandle, (EVENT_DESCRIPTOR *)&PPM_ETW_CURRENT_PERF_RUNDOWN, a3) )
{
v6 = *(_QWORD *)(a1 + 33128);
v7 = *(_DWORD **)(a1 + 33136);
v25 = *(unsigned __int8 *)(a1 + 33212);
v26 = *(_DWORD *)(a1 + 33268);
if( v6 )
{
v8 = *(_DWORD *)(v6 + 316);
v15 = v8;
v20 = *(_BYTE *)(v6 + 359) != 0;
v9 = *(unsigned __int8 *)(v6 + 352);
}
else
{
v8 = *(_DWORD *)(a1 + 68);
v9 = 100;
v15 = v8;
v20 = 0;
}
v27 = v9;
if( v7 )
{
v12 = v7[6];
v13 = v7[7];
v14 = v7[18];
v16 = v7[20];
v17 = v7[21];
v18 = v7[22];
v21 = v7[23];
v22 = v7[24];
v23 = v7[19];
v19 = v7[30];
v8 = v8 * v7[29] / 0x64;
}
else
{
v12 = 100;
v13 = 100;
v14 = 100;
v16 = 100;
v17 = 100;
v18 = 100;
v21 = 0;
v22 = 0;
v23 = v8;
v19 = 100;
}
v11 = *(unsigned __int8 *)(a1 + 208);
v24 = v8;
UserData.Ptr = (unsigned __int64)&v11;
*(_QWORD *)&UserData.Size = 2i64;
v30 = a1 + 209;
v31 = 1i64;
v32 = &v25;
v34 = &v12;
v36 = &v13;
v38 = &v14;
v40 = (int *)&v15;
v42 = &v16;
v44 = &v17;
v46 = &v18;
v48 = &v19;
v50 = a1 + 33208;
v52 = a1 + 33209;
v54 = &v20;
v56 = &v21;
v58 = &v22;
v60 = &v26;
v62 = &v27;
v64 = a1 + 33210;
v66 = (int *)&v23;
v28 = *(unsigned __int8 *)(a1 + 32819);
v68 = &v28;
v70 = (int *)&v24;
v33 = 4i64;
v35 = 4i64;
v37 = 4i64;
v39 = 4i64;
v41 = 4i64;
v43 = 4i64;
v45 = 4i64;
v47 = 4i64;
v49 = 4i64;
v51 = 1i64;
v53 = 1i64;
v55 = 4i64;
v57 = 4i64;
v59 = 4i64;
v61 = 4i64;
v63 = 4i64;
v65 = 1i64;
v67 = 4i64;
v69 = 4i64;
v71 = 4i64;
EtwWrite(v5, (EVENT_DESCRIPTOR *)&PPM_ETW_CURRENT_PERF_RUNDOWN, 0i64, 0x16ui64, &UserData);
if( v6 )
{
if( *(_QWORD *)(v6 + 16) == a1 + 33128 && *(_DWORD *)(v6 + 200) )
{
do
{
v10 = (_DWORD *)(*(_QWORD *)(v6 + 216) + 136i64 * v3);
if( v10[4] == 2 )
PpmEventHiddenProcessorPerformance(
a1,
(unsigned int)v10[5],
(EVENT_DESCRIPTOR *)(unsigned int)v10[6],
(unsigned int)v10[7]);
++v3;
}
while( v3 < *(_DWORD *)(v6 + 200) );
}
}
}
}
}Referenced by:
PpmEventTraceControlCallback