PopDiagTraceIrpStart

VOID __stdcall PopDiagTraceIrpStart(IRP *Irp, IRP *a2){
  EVENT_DESCRIPTOR *v2; 
  __int64 v3; 
  __int64 v4; 
  char v5; 
  int v6; 
  __int64 v7; 
  INT64 v8; 
  __int16 v9; 
  UINT64 v10; 
  unsigned int v11; 
  __int64 v12; 
  __int64 v13; 
  UINT64 UserDataCount; 
  char v15; 
  char v16; 
  __int16 v17; 
  int v18; 
  IRP *v19; 
  INT64 v20; 
  struct _UNICODE_STRING DestinationString; 
  EVENT_DATA_DESCRIPTOR UserData; 
  int *v23; 
  __int64 v24; 
  char *v25; 
  __int64 v26; 
  __int64 *v27; 
  __int64 v28; 
  __int16 *v29; 
  __int64 v30; 
  __int64 v31; 
  int v32; 
  int v33; 
  v19 = a2;
  v3 = *((char *)a2 + 66);
  DestinationString = 0i64;
  v4 = *((_QWORD *)a2 + 9 * v3 + 25);
  v5 = *(_BYTE *)(v4 + 184);
  v15 = v5;
  v6 = *(_DWORD *)(v4 + 188);
  v18 = v6;
  v16 = *(_BYTE *)(v4 + 192) - 1;
  v7 = *(_QWORD *)(v4 + 24);
  if( v7 )
    v8 = *(_QWORD *)(*(_QWORD *)(v7 + 312) + 40i64);
  else
    v8 = 0i64;
  v20 = v8;
  v9 = *(_WORD *)(v8 + 40) >> 1;
  v17 = v9;
  if( !*(_QWORD *)(v8 + 16) )
    RtlInitUnicodeString(&DestinationString, &ppszDestEnd, (WCHAR)v2);
  if( v6 == 1 && v5 == 2 )
  {
    PopFxAddLogEntry(v8, 0, 22, *(int *)(v4 + 192));
    v9 = v17;
  }
  if( PopDiagHandleRegistered )
  {
    v10 = PopDiagHandle;
    if( EtwEventEnabled(PopDiagHandle, (EVENT_DESCRIPTOR *)&POP_ETW_EVENT_IRPSTART, v2) )
    {
      *(_QWORD *)&UserData.Size = 8i64;
      UserData.Ptr = (unsigned __int64)&v19;
      v23 = &v18;
      v25 = &v15;
      v27 = &v20;
      v29 = &v17;
      v11 = 5;
      v24 = 4i64;
      v26 = 1i64;
      v28 = 8i64;
      v30 = 2i64;
      if( v9 )
      {
        v12 = *(_QWORD *)(v8 + 48);
        v32 = *(unsigned __int16 *)(v8 + 40);
        v11 = 6;
        v31 = v12;
        v33 = 0;
      }
      v13 = 2i64 * v11;
      *(&UserData.Ptr + v13) = (unsigned __int64)&v16;
      *((_QWORD *)&UserData.Size + v13) = 1i64;
      LODWORD(UserDataCount) = v11 + 1;
      EtwWriteEx(v10, (EVENT_DESCRIPTOR *)&POP_ETW_EVENT_IRPSTART, 0i64, 0i64, 0i64, 0i64, UserDataCount, &UserData);
    }
  }
}

Referenced by: