PopDiagTracePowerRequestCreate
VOID __stdcall PopDiagTracePowerRequestCreate(UINT8 Rundown, _PO_POWER_REQUEST *Request){
const _EVENT_DESCRIPTOR *v4;
int *v5;
VOID **PoolWithTag;
VOID **v7;
VOID *v8;
UINT64 v9;
_WORD *v10;
__int64 v11;
unsigned __int16 v12;
WCHAR *v13;
_PO_POWER_REQUEST *v14;
int v15;
_PO_POWER_REQUEST v16;
bool v17;
int v18;
unsigned int v19;
unsigned __int16 v20;
unsigned __int16 v21;
__int64 v22;
const _EVENT_DESCRIPTOR *v23;
__int64 v24;
unsigned int v25;
__int64 v26;
__int64 v27;
__int64 v28;
__int64 v29;
ULONG v30;
__int64 v31;
VOID *v32;
wchar_t *v33;
__int64 v34;
_WORD *v35;
__int64 v36;
wchar_t *v37;
unsigned __int16 v38;
__int16 v39;
int v40;
int v41;
int v42;
int v43;
NTSTATUS SessionId;
int v45;
int v46;
int v47;
int v48;
int v49;
_PO_POWER_REQUEST *v50;
UINT64 BufferSizePointer[2];
_UNICODE_STRING DestinationString;
_EVENT_DATA_DESCRIPTOR UserData;
int *v54;
__int64 v55;
int *v56;
__int64 v57;
NTSTATUS *p_SessionId;
__int64 v59;
int *v60;
__int64 v61;
int *v62;
__int64 v63;
int *v64;
__int64 v65;
int *v66;
__int64 v67;
_PO_POWER_REQUEST *v68;
__int64 v69;
_PO_POWER_REQUEST *v70;
__int64 v71;
_PO_POWER_REQUEST *v72;
__int64 v73;
__int16 *v74;
__int64 v75;
__int16 *v76;
__int64 v77;
UINT64 v78;
int v79;
int v80;
WCHAR pszDest[24];
v50 = Request;
v38 = 0;
v39 = 0;
DestinationString = 0i64;
if( PopDiagHandleRegistered )
{
v4 = &POP_ETW_EVENT_CREATE_POWER_REQUEST;
if( Rundown )
v4 = (const _EVENT_DESCRIPTOR *)POP_ETW_EVENT_POWER_REQUEST_RUNDOWN;
if( EtwEventEnabled(PopDiagHandle, v4) )
{
v5 = (int *)*((_QWORD *)Request + 10);
BufferSizePointer[0] = 0i64;
v40 = *v5;
v43 = 0;
SessionId = 0;
v41 = 0;
v45 = 0;
v46 = 0;
v47 = 0;
v42 = 0;
v49 = 0;
v48 = 0;
PoStoreRequester(*((_DIAGNOSTIC_CONTEXT **)Request + 10), 0i64, BufferSizePointer, 0);
PoolWithTag = ExAllocatePoolWithTag(1ui64, BufferSizePointer[0], 1346721364i64);
v7 = PoolWithTag;
if( PoolWithTag )
{
if( PoStoreRequester(
*((_DIAGNOSTIC_CONTEXT **)v50 + 10),
(_DIAGNOSTIC_BUFFER *)PoolWithTag,
BufferSizePointer,
0) >= 0 )
{
if( v40 )
{
v43 = *((_DWORD *)v7 + 6);
SessionId = MmGetSessionIdEx(*(_EPROCESS **)(*((_QWORD *)v50 + 10) + 8i64));
v8 = v7[2];
*(_OWORD *)BufferSizePointer = 0i64;
v9 = (UINT64)v8 + (_QWORD)v7;
if( !v9 )
goto LABEL_54;
v10 = (_WORD *)v9;
v11 = 0x7FFFi64;
do
{
if( !*v10 )
break;
++v10;
--v11;
}
while( v11 );
if( v11 )
{
v12 = 2 * (v11 != 0 ? 0x7FFF - v11 : 0);
}
else
{
LABEL_54:
v9 = BufferSizePointer[1];
v12 = BufferSizePointer[0];
}
if( v40 == 2 )
{
RtlStringCbPrintfW(pszDest, 0x2Cui64, (WCHAR *)L"%d");
v13 = pszDest;
}
else
{
v13 = 0i64;
}
RtlInitUnicodeString(&DestinationString, v13);
}
else
{
v32 = v7[2];
v33 = (wchar_t *)((char *)v7[3] + (_QWORD)v7);
*(_OWORD *)BufferSizePointer = 0i64;
v9 = (UINT64)v32 + (_QWORD)v7;
if( !v9 )
goto LABEL_53;
v34 = 0x7FFFi64;
v35 = (_WORD *)v9;
do
{
if( !*v35 )
break;
++v35;
--v34;
}
while( v34 );
if( v34 )
{
v12 = 2 * (v34 != 0 ? 0x7FFF - v34 : 0);
}
else
{
LABEL_53:
v9 = BufferSizePointer[1];
v12 = BufferSizePointer[0];
}
if( v33 )
{
v36 = 0x7FFFi64;
v37 = v33;
do
{
if( !*v37 )
break;
++v37;
--v36;
}
while( v36 );
if( v36 )
{
DestinationString.Buffer = v33;
DestinationString.Length = 2 * (v36 != 0 ? 0x7FFF - v36 : 0);
}
}
}
v14 = v50;
v15 = v41;
if( !*((_QWORD *)v50 + 10) )
v15 = 1;
v41 = v15;
v16 = v50[5];
if( (v16 & 2) != 0 )
{
v45 = 1;
v16 = v50[5];
}
if( (v16 & 1) != 0 )
{
v46 = 1;
v16 = v50[5];
}
if( (v16 & 4) != 0 )
{
v47 = 1;
v16 = v50[5];
}
if( (v16 & 8) != 0 )
{
v48 = 1;
v16 = v50[5];
}
if( (v16 & 0x10) != 0 )
{
v49 = 1;
v16 = v50[5];
}
v17 = (v16 & 0x20) == 0;
v18 = v42;
v19 = 13;
if( !v17 )
v18 = 1;
*(_QWORD *)&UserData.Size = 8i64;
v42 = v18;
UserData.Ptr = (unsigned __int64)&v50;
v54 = &v40;
v56 = &v43;
p_SessionId = &SessionId;
v60 = &v41;
v62 = &v45;
v64 = &v46;
v66 = &v47;
v68 = v50 + 9;
v70 = v50 + 8;
v72 = v50 + 10;
v20 = v12 >> 1;
v21 = DestinationString.Length >> 1;
v74 = (__int16 *)&v38;
v76 = &v39;
v38 = v20;
v39 = DestinationString.Length >> 1;
v55 = 4i64;
v57 = 4i64;
v59 = 4i64;
v61 = 4i64;
v63 = 4i64;
v65 = 4i64;
v67 = 4i64;
v69 = 4i64;
v71 = 4i64;
v73 = 4i64;
v75 = 2i64;
v77 = 2i64;
if( v20 )
{
v19 = 14;
v78 = v9;
v79 = 2 * v20;
v80 = 0;
}
if( v21 )
{
v31 = 2i64 * v19;
*(&UserData.Ptr + v31) = (unsigned __int64)DestinationString.Buffer;
*(&UserData.Reserved + 2 * v31) = 0;
*(&UserData.Size + 2 * v31) = 2 * v21;
++v19;
}
v22 = 2i64 * v19;
v23 = (const _EVENT_DESCRIPTOR *)POP_ETW_EVENT_POWER_REQUEST_RUNDOWN;
*(&UserData.Ptr + v22) = (unsigned __int64)&v48;
*((_QWORD *)&UserData.Size + v22) = 4i64;
v24 = v19 + 1;
v25 = v19 + 2;
v24 *= 2i64;
*(&UserData.Ptr + v24) = (unsigned __int64)&v49;
*((_QWORD *)&UserData.Size + v24) = 4i64;
v26 = 2i64 * v25;
*(&UserData.Ptr + v26) = (unsigned __int64)&v42;
*((_QWORD *)&UserData.Size + v26) = 4i64;
v27 = v25 + 1;
v25 += 2;
v27 *= 2i64;
*(&UserData.Ptr + v27) = (unsigned __int64)(v14 + 11);
*((_QWORD *)&UserData.Size + v27) = 4i64;
v28 = 2i64 * v25;
*(&UserData.Ptr + v28) = (unsigned __int64)(v14 + 12);
*((_QWORD *)&UserData.Size + v28) = 4i64;
v29 = v25 + 1;
v30 = v25 + 2;
v29 *= 2i64;
*(&UserData.Ptr + v29) = (unsigned __int64)(v14 + 13);
*((_QWORD *)&UserData.Size + v29) = 4i64;
if( !Rundown )
v23 = &POP_ETW_EVENT_CREATE_POWER_REQUEST;
EtwWrite(PopDiagHandle, v23, 0, v30, &UserData);
}
ExFreePoolWithTag(v7, 0x50455654u);
}
}
}
}Referenced by:
PopCreateKernelPowerRequest
PopCreateUserPowerRequest
PopDiagTraceControlCallback