PopDiagTraceFxComponentAccounting

VOID __stdcall PopDiagTraceFxComponentAccounting(_DEVICE_NODE *DevNode, UINT64 Component, UINT64 ActiveTime){
  unsigned __int16 *v3; 
  unsigned __int16 *v4; 
  REGHANDLE v6; 
  _DEVICE_OBJECT *PhysicalDeviceObject; 
  bool v8; 
  NTSTATUS DevicePropertyString; 
  wchar_t *Buffer; 
  bool v11; 
  wchar_t *v12; 
  int Length; 
  __int64 v14; 
  char v15; 
  int v16; 
  _DEVICE_NODE *v17; 
  _UNICODE_STRING DestinationString; 
  _UNICODE_STRING v19; 
  UINT64 v20; 
  __int64 v21; 
  __int64 v22; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  _DEVICE_NODE **v24; 
  __int64 v25; 
  int *v26; 
  __int64 v27; 
  char *v28; 
  __int64 v29; 
  UINT64 *v30; 
  __int64 v31; 
  _EVENT_DATA_DESCRIPTOR v32; 
  UINT64 *v33; 
  __int64 v34; 
  int *v35; 
  __int64 v36; 
  __int64 v37; 
  int v38[2]; 
  int *v39; 
  __int64 v40; 
  __int64 *v41; 
  __int64 v42; 
  UINT64 v43; 
  __int64 v44; 
  UINT64 v45; 
  __int64 v46; 
  __int64 *v47; 
  __int64 v48; 
  int *v49; 
  __int64 v50; 
  wchar_t *v51; 
  int v52[2]; 
  int *v53; 
  __int64 v54; 
  wchar_t *v55; 
  int v56[2]; 
  int *v57; 
  __int64 v58; 
  __int64 v59; 
  int v60[2]; 
  int v61; 
  char v62; 

  v61 = Component;
  v17 = DevNode;
  v4 = v3;
  DestinationString = 0i64;
  v19 = 0i64;
  RtlInitUnicodeString(&DestinationString, (PCWSTR)&dword_1407CF120);
  RtlInitUnicodeString(&v19, (PCWSTR)&dword_1407CF120);
  if( PopDiagHandleRegistered )
  {
    v6 = PopDiagHandle;
    if( EtwEventEnabled(PopDiagHandle, &POP_ETW_EVENT_COMPONENT_ACCOUNTING) )
    {
      v15 = PopWnfCsEnterScenarioId;
      *(_QWORD *)&UserData.Size = 1i64;
      UserData.Ptr = (unsigned __int64)&v15;
      v25 = 8i64;
      v24 = &v17;
      v27 = 4i64;
      v26 = &v61;
      v29 = 8i64;
      v28 = &v62;
      v31 = 8i64;
      v30 = &PopWnfCsEnterScenarioId;
      EtwWrite(v6, &POP_ETW_EVENT_COMPONENT_ACCOUNTING, 0, 5u, &UserData);
      if( *(_DWORD *)(ActiveTime + 12) != -1 && !*(&stru_140CF2E80 + 1947) )
      {
        PhysicalDeviceObject = v17->PhysicalDeviceObject;
        v8 = PopDiagQueryDevicePropertyString(PhysicalDeviceObject, 5) >= 0;
        DevicePropertyString = PopDiagQueryDevicePropertyString(PhysicalDeviceObject, 6);
        Buffer = DestinationString.Buffer;
        v11 = DevicePropertyString >= 0;
        v12 = v19.Buffer;
        if( *(&stru_140C00F40 + 1194) > 5u && tlgKeywordOn((__int64)&stru_140C00F40 + 4776, 0x400000000000i64) )
        {
          v20 = PopWnfCsEnterScenarioId;
          v34 = 8i64;
          v33 = &v20;
          Length = v17->InstancePath.Length;
          v14 = (__int64)v17->InstancePath.Buffer;
          v35 = v38;
          v16 = v61;
          v39 = &v16;
          v21 = *(_QWORD *)(ActiveTime + 32);
          v41 = &v21;
          v43 = ActiveTime + 48;
          v45 = ActiveTime + 88;
          v22 = *(_QWORD *)(ActiveTime + 40);
          v47 = &v22;
          v49 = v52;
          v52[0] = DestinationString.Length;
          v53 = v56;
          v56[0] = v19.Length;
          v57 = v60;
          v59 = *((_QWORD *)v4 + 1);
          v60[0] = *v4;
          v37 = v14;
          v38[0] = Length;
          v36 = 2i64;
          v38[1] = 0;
          v40 = 4i64;
          v42 = 8i64;
          v44 = 40i64;
          v46 = 40i64;
          v48 = 8i64;
          v50 = 2i64;
          v51 = Buffer;
          v52[1] = 0;
          v54 = 2i64;
          v55 = v12;
          v56[1] = 0;
          v58 = 2i64;
          v60[1] = 0;
          tlgWriteTransfer_EtwWriteTransfer(
            (__int64)&stru_140C00F40 + 4776,
            (unsigned __int8 *)&dword_14002762C,
            0i64,
            0i64,
            0x10u,
            &v32);
        }
        if( v8 )
          ExFreePoolWithTag(Buffer, 0x67696450u);
        if( v11 )
          ExFreePoolWithTag(v12, 0x67696450u);
      }
    }
  }
}

Referenced by:

PopFxStopDeviceAccounting