PpmEventVetoReasonRundown
VOID __stdcall PpmEventVetoReasonRundown(){
EVENT_DESCRIPTOR *v0;
__int64 v1;
__int64 v2;
unsigned int v3;
__int64 v4;
int v5;
__int64 v6;
unsigned int v7;
EVENT_DATA_DESCRIPTOR UserData;
__int64 v9;
int v10;
int v11;
v7 = 0;
if( PpmEtwRegistered )
{
if( EtwEventEnabled(PpmEtwHandle, (EVENT_DESCRIPTOR *)&PPM_ETW_VETO_NAME_RUNDOWN, v0) )
{
v1 = PpmIdleVetoList;
if( PpmIdleVetoList )
{
UserData.Reserved = 0;
UserData.Ptr = (unsigned __int64)&v7;
v2 = 0i64;
UserData.Size = 4;
if( *(_DWORD *)PpmIdleVetoList )
{
do
{
v3 = v2 + 1;
v4 = 2 * v2;
v7 = v3;
v5 = *(unsigned __int16 *)(v1 + 8 * v4 + 10);
v6 = *(_QWORD *)(v1 + 8 * v4 + 16);
v11 = 0;
v9 = v6;
v10 = v5;
EtwWrite(PpmEtwHandle, (EVENT_DESCRIPTOR *)&PPM_ETW_VETO_NAME_RUNDOWN, 0i64, 2ui64, &UserData);
v1 = PpmIdleVetoList;
v2 = v3;
}
while( v3 < *(_DWORD *)PpmIdleVetoList );
}
}
}
}
}Referenced by:
PpmEventTraceControlCallback