PopDiagTraceFxComponentAccounting
VOID __stdcall PopDiagTraceFxComponentAccounting(_DEVICE_NODE *DevNode, UINT64 Component, UINT64 ActiveTime){
unsigned __int16 *v3;
unsigned __int16 *v4;
REGHANDLE v6;
_DEVICE_OBJECT *PhysicalDeviceObject;
bool v8;
NTSTATUS DevicePropertyString;
wchar_t *Buffer;
bool v11;
wchar_t *v12;
int Length;
__int64 v14;
char v15;
int v16;
_DEVICE_NODE *v17;
_UNICODE_STRING DestinationString;
_UNICODE_STRING v19;
UINT64 v20;
__int64 v21;
__int64 v22;
_EVENT_DATA_DESCRIPTOR UserData;
_DEVICE_NODE **v24;
__int64 v25;
int *v26;
__int64 v27;
char *v28;
__int64 v29;
UINT64 *v30;
__int64 v31;
_EVENT_DATA_DESCRIPTOR v32;
UINT64 *v33;
__int64 v34;
int *v35;
__int64 v36;
__int64 v37;
int v38[2];
int *v39;
__int64 v40;
__int64 *v41;
__int64 v42;
UINT64 v43;
__int64 v44;
UINT64 v45;
__int64 v46;
__int64 *v47;
__int64 v48;
int *v49;
__int64 v50;
wchar_t *v51;
int v52[2];
int *v53;
__int64 v54;
wchar_t *v55;
int v56[2];
int *v57;
__int64 v58;
__int64 v59;
int v60[2];
int v61;
char v62;
v61 = Component;
v17 = DevNode;
v4 = v3;
DestinationString = 0i64;
v19 = 0i64;
RtlInitUnicodeString(&DestinationString, (PCWSTR)&dword_1407CF120);
RtlInitUnicodeString(&v19, (PCWSTR)&dword_1407CF120);
if( PopDiagHandleRegistered )
{
v6 = PopDiagHandle;
if( EtwEventEnabled(PopDiagHandle, &POP_ETW_EVENT_COMPONENT_ACCOUNTING) )
{
v15 = PopWnfCsEnterScenarioId;
*(_QWORD *)&UserData.Size = 1i64;
UserData.Ptr = (unsigned __int64)&v15;
v25 = 8i64;
v24 = &v17;
v27 = 4i64;
v26 = &v61;
v29 = 8i64;
v28 = &v62;
v31 = 8i64;
v30 = &PopWnfCsEnterScenarioId;
EtwWrite(v6, &POP_ETW_EVENT_COMPONENT_ACCOUNTING, 0, 5u, &UserData);
if( *(_DWORD *)(ActiveTime + 12) != -1 && !*(&stru_140CF2E80 + 1947) )
{
PhysicalDeviceObject = v17->PhysicalDeviceObject;
v8 = PopDiagQueryDevicePropertyString(PhysicalDeviceObject, 5) >= 0;
DevicePropertyString = PopDiagQueryDevicePropertyString(PhysicalDeviceObject, 6);
Buffer = DestinationString.Buffer;
v11 = DevicePropertyString >= 0;
v12 = v19.Buffer;
if( *(&stru_140C00F40 + 1194) > 5u && tlgKeywordOn((__int64)&stru_140C00F40 + 4776, 0x400000000000i64) )
{
v20 = PopWnfCsEnterScenarioId;
v34 = 8i64;
v33 = &v20;
Length = v17->InstancePath.Length;
v14 = (__int64)v17->InstancePath.Buffer;
v35 = v38;
v16 = v61;
v39 = &v16;
v21 = *(_QWORD *)(ActiveTime + 32);
v41 = &v21;
v43 = ActiveTime + 48;
v45 = ActiveTime + 88;
v22 = *(_QWORD *)(ActiveTime + 40);
v47 = &v22;
v49 = v52;
v52[0] = DestinationString.Length;
v53 = v56;
v56[0] = v19.Length;
v57 = v60;
v59 = *((_QWORD *)v4 + 1);
v60[0] = *v4;
v37 = v14;
v38[0] = Length;
v36 = 2i64;
v38[1] = 0;
v40 = 4i64;
v42 = 8i64;
v44 = 40i64;
v46 = 40i64;
v48 = 8i64;
v50 = 2i64;
v51 = Buffer;
v52[1] = 0;
v54 = 2i64;
v55 = v12;
v56[1] = 0;
v58 = 2i64;
v60[1] = 0;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&stru_140C00F40 + 4776,
(unsigned __int8 *)&dword_14002762C,
0i64,
0i64,
0x10u,
&v32);
}
if( v8 )
ExFreePoolWithTag(Buffer, 0x67696450u);
if( v11 )
ExFreePoolWithTag(v12, 0x67696450u);
}
}
}
}Referenced by:
PopFxStopDeviceAccounting