PopTraceZoneCr3Mitigated
VOID __fastcall PopTraceZoneCr3Mitigated(UINT64 GenerationId, _POP_THERMAL_ZONE *ThermalZone){
int v3;
DEVICE_OBJECT *DeviceAttachmentBaseRefWithTag;
DEVICE_OBJECT *v5;
__int64 v6;
__int64 v7;
const WCHAR *v8;
int v9;
unsigned int CurrentTemperature;
struct _EVENT_DATA_DESCRIPTOR v11;
int *v12;
int v13;
int v14;
unsigned int *p_CurrentTemperature;
int v16;
int v17;
char v18[16];
v3 = GenerationId;
DeviceAttachmentBaseRefWithTag = IoGetDeviceAttachmentBaseRefWithTag(ThermalZone->PolicyDevice.Device, 0x67446F50ui64);
v5 = DeviceAttachmentBaseRefWithTag;
if( DeviceAttachmentBaseRefWithTag )
v6 = *(_QWORD *)(*((_QWORD *)DeviceAttachmentBaseRefWithTag + 39) + 40i64);
else
v6 = 0i64;
if( v6 && (unsigned int)dword_140C021E8 > 5 && tlgKeywordOn((__int64)&dword_140C021E8, 0x400000000000i64) )
{
v14 = 0;
v17 = 0;
v12 = &v9;
CurrentTemperature = ThermalZone->Info.CurrentTemperature;
v13 = 4;
v16 = 4;
v8 = *(const WCHAR **)(v7 + 136);
p_CurrentTemperature = &CurrentTemperature;
v9 = v3;
tlgCreate1Sz_wchar_t((__int64)v18, v8);
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&dword_140C021E8,
(unsigned __int8 *)byte_1400272A1,
0i64,
0i64,
5u,
&v11);
}
if( v5 )
ObfDereferenceObjectWithTag(v5, 0x67446F50ui64);
}Referenced by:
PopCheckAndHandleThermalConditions
PopThermalZoneRemove