PpmEventTraceCoordinatedIdleStates
_QWORD __stdcall PpmEventTraceCoordinatedIdleStates(){
__int64 result;
EVENT_DESCRIPTOR *v1;
UINT64 v2;
unsigned int v3;
unsigned int v4;
EVENT_DATA_DESCRIPTOR *UserData;
__int64 v6;
EVENT_DATA_DESCRIPTOR *v7;
int v8;
EVENT_DATA_DESCRIPTOR *v9;
const wchar_t *v10;
int v11;
unsigned int v12;
if( PpmEtwRegistered )
{
LOBYTE(result) = EtwEventEnabled(PpmEtwHandle, (EVENT_DESCRIPTOR *)&PPM_ETW_COORDINATED_IDLE_RUNDOWN, v1);
if( (_BYTE)result )
{
v2 = PpmPlatformStates;
v3 = PpmPlatformStates ? *(_DWORD *)PpmPlatformStates : 0;
v12 = v3;
v4 = 2 * v3 + 1;
result = (__int64)ExAllocatePoolWithTag(PagedPool, 16 * v4 + 12 * v3, 0x654D5050ui64);
UserData = (EVENT_DATA_DESCRIPTOR *)result;
if( result )
{
memset(result, 0i64);
UserData->Reserved = 0;
v6 = 0i64;
v7 = &UserData[v4];
UserData->Ptr = (unsigned __int64)&v12;
for( UserData->Size = 4; (unsigned int)v6 < v12; UserData[v8 + 2].Reserved = 0 )
{
v8 = 2 * v6;
v9 = &UserData[(unsigned int)(2 * v6 + 1)];
LODWORD(v7->Ptr) = *(_DWORD *)(384 * v6 + v2 + 72);
HIDWORD(v7->Ptr) = *(_DWORD *)(384 * v6 + v2 + 76);
v7->Size = *(unsigned __int8 *)(384 * v6 + v2 + 121);
v9->Reserved = 0;
v9->Ptr = (unsigned __int64)v7;
v9->Size = 12;
v10 = *(const wchar_t **)(384 * v6 + v2 + 304);
if( v10 )
{
v11 = *(unsigned __int16 *)(384 * v6 + v2 + 298);
}
else
{
v11 = 28;
v10 = L"";
}
UserData[v8 + 2].Ptr = (unsigned __int64)v10;
v7 = (EVENT_DATA_DESCRIPTOR *)((char *)v7 + 12);
UserData[v8 + 2].Size = v11;
v6 = (unsigned int)(v6 + 1);
}
EtwWrite(PpmEtwHandle, (EVENT_DESCRIPTOR *)&PPM_ETW_COORDINATED_IDLE_RUNDOWN, 0i64, v4, UserData);
ExFreePoolWithTag(UserData, 0x654D5050u);
}
}
}
return result;
}Referenced by:
PpmEventTraceControlCallback