PpmWmiFireIdleAccountingEvent

__int64 __fastcall PpmWmiFireIdleAccountingEvent(__int64 a1){
  _QWORD *v1; 
  _DWORD *v2; 
  tagWNODE_SINGLE_INSTANCE *v3; 
  tagWNODE_SINGLE_INSTANCE *v4; 
  NTSTATUS v5; 
  v1 = (_QWORD *)(a1 + 0x8000);
  if( *(_QWORD *)(a1 + 0x8000) && (v2 = *(_DWORD **)(a1 + 32776)) != 0i64 && *(_DWORD *)(a1 + 33000) )
  {
    v3 = PpmAllocWmiEvent((VOID *)(a1 + 32992), (GUID *)&PPM_IDLE_ACCOUNTING_EX_GUID, (unsigned int)(416 * *v2 + 24));
    v4 = v3;
    if( v3 )
    {
      PpmTranslateIdleAccounting(v1, (INT64)v3 + v3->DataBlockOffset, 0i64);
      v5 = IoWMIWriteEvent(v4);
      if( v5 >= 0 )
        return 0;
      else
        ExFreePoolWithTag(v4, 0x774D5050u);
    }
    else
    {
      return(unsigned int)-1073741670;
    }
  }
  else
  {
    return(unsigned int)-1073741823;
  }
  return(unsigned int)v5;
}

Referenced by: