PopDiagTracePerfTrackData
_EXCEPTION_DISPOSITION __stdcall PopDiagTracePerfTrackData(_KNOWN_CONTROLLER_TYPE a1, _KNOWN_CONTROLLER_TYPE a2){
_EXCEPTION_DISPOSITION result;
__int16 v3;
unsigned __int64 v4;
int v5;
int v6;
__int64 v7;
int v8;
int v9;
int v10;
unsigned __int64 v11;
int v12;
__int64 v13;
$9809CEAD2DA957FAEE8580DC38A49918 *v14;
__int64 v15;
__int128 *v16;
const _EVENT_DESCRIPTOR *v17;
unsigned int v18;
__int64 v19;
int v20;
int v21;
int v22;
unsigned __int64 v23;
__int64 v24;
__int16 v25;
$9809CEAD2DA957FAEE8580DC38A49918 *v26;
__int64 v27;
__int128 *v28;
int v29;
int v30;
int v31;
int v32;
int v33;
_LARGE_INTEGER StartTime;
int v35;
int v36;
int v37;
int v38;
__int128 v39;
__int128 v40;
__int64 v41;
_EVENT_DATA_DESCRIPTOR UserData;
int *v43;
__int64 v44;
int *v45;
__int64 v46;
int *v47;
__int64 v48;
int *v49;
__int64 v50;
result = ExceptionContinueExecution;
v3 = a1;
StartTime.QuadPart = 0i64;
v39 = 0i64;
v41 = 0i64;
v40 = 0i64;
if( PopDiagHandleRegistered )
{
LOBYTE(result) = EtwEventEnabled(PopDiagHandle, &POP_ETW_EVENT_TRANSITIONTIMES);
if( (_BYTE)result )
{
v4 = 1000i64 * KeGetPrcb(0i64)->MHz;
v36 = PopQpcTimeInMs((_LARGE_INTEGER *)&stru_140C23628 + 47, (_LARGE_INTEGER *)&stru_140C23628 + 48);
v35 = PopQpcTimeInMs((_LARGE_INTEGER *)&stru_140C23628 + 45, (_LARGE_INTEGER *)&stru_140C23628 + 46);
if( *(&stru_140C23628 + 44) )
{
StartTime.QuadPart = 0i64;
v31 = PopQpcTimeInMs(&StartTime, (_LARGE_INTEGER *)&stru_140C23628 + 44);
v29 = v31 + PopQpcTimeInMs((_LARGE_INTEGER *)&stru_140C23628 + 40, (_LARGE_INTEGER *)&stru_140C23628 + 41);
*(_QWORD *)&UserData.Size = 4i64;
UserData.Ptr = (unsigned __int64)&stru_140C23628 + 800;
v43 = &v29;
v45 = &v31;
v47 = &v35;
v49 = &v36;
v44 = 4i64;
v46 = 4i64;
v48 = 4i64;
v50 = 4i64;
return EtwWrite(PopDiagHandle, (PCEVENT_DESCRIPTOR)POP_ETW_EVENT_PERFTRACK_STANDBY, 0, 5u, &UserData);
}
result = *(&stru_140C23628 + 218);
if( *(&stru_140C23628 + 218) )
{
v5 = *(&stru_140C23628 + 116);
v32 = (4 * *(&stru_140C23628 + 218)) & 0x3FFFFF;
v38 = *(&stru_140C23628 + 116);
v33 = *(&stru_140C23628 + 53) / v4;
result = *(&stru_140C23628 + 222);
v29 = *(&stru_140C23628 + 222);
if( (v3 & 8) != 0 )
{
if( !*(&stru_140C23628 + 597) )
return result;
v30 = PopQpcTimeInMs((_LARGE_INTEGER *)&stru_140C23628 + 597, (_LARGE_INTEGER *)&stru_140C23628 + 36) + v5;
if( PopReadRegKeyValue(
(WCHAR *)L"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon",
(WCHAR *)L"LastLogOffEndTimePerfCounter",
8i64,
0i64,
&StartTime) < 0 )
v6 = 0;
else
v6 = PopQpcTimeInMs(&StartTime, (_LARGE_INTEGER *)&stru_140C23628 + 59);
v37 = v6;
*(_QWORD *)&UserData.Size = 4i64;
UserData.Ptr = (unsigned __int64)&v32;
v44 = 4i64;
v43 = &v30;
v46 = 4i64;
v45 = &v33;
v47 = &v37;
v48 = 4i64;
EtwWrite(PopDiagHandle, &POP_ETW_EVENT_PERFTRACK_HYBRID_SHUTDOWN, 0, 4u, &UserData);
PopComputeDerivedHiberStats((unsigned __int64 *)&stru_140C23628 + 50, v4, (__int64)&v39);
LODWORD(v40) = v29;
v7 = *(&stru_140C23628 + 106) >> 8;
WORD3(v40) = -1;
if( *(&stru_140C23628 + 106) >> 8 > 0x7FFFui64 )
LOWORD(v7) = 0x7FFF;
WORD2(v40) = v7 & 0x7FFF;
if( *(&stru_140C23628 + 107) >> 8 <= 0xFFFFui64 )
WORD3(v40) = *(&stru_140C23628 + 214) >> 8;
WORD4(v40) = -1;
if( *(&stru_140C23628 + 62) / v4 <= 0xFFFF )
WORD4(v40) = *(&stru_140C23628 + 62) / v4;
WORD5(v40) = -1;
if( *(&stru_140C23628 + 92) / v4 <= 0xFFFF )
WORD5(v40) = *(&stru_140C23628 + 92) / v4;
WORD6(v40) = -1;
if( *(&stru_140C23628 + 120) <= 0xFFFFu )
WORD6(v40) = *(&stru_140C23628 + 240);
HIWORD(v40) = -1;
if( *(&stru_140C23628 + 200) <= 0xFFFFu )
HIWORD(v40) = *(&stru_140C23628 + 400);
v8 = DWORD1(v39);
HIWORD(v41) = -1;
if( DWORD1(v39) > 0x3FF )
v8 = 1023;
v9 = HIDWORD(v39);
if( HIDWORD(v39) > 0x1FF )
v9 = 511;
v10 = v8 ^ (v8 ^ (v9 << 10)) & 0x7FC00;
v11 = (*(&stru_140C23628 + 78) - *(&stru_140C23628 + 85)) / v4;
if( v11 > 0x1FFF )
LODWORD(v11) = 0x1FFF;
v12 = ((_DWORD)v11 << 19) | v10 & 0x7FFFF;
v13 = *(&stru_140C23628 + 102) >> 8;
LODWORD(v41) = v12;
if( *(&stru_140C23628 + 102) >> 8 > 0x7FFFui64 )
LOWORD(v13) = 0x7FFF;
WORD2(v41) = v13 & 0x7FFF;
if( *(&stru_140C23628 + 103) >> 8 <= 0xFFFFui64 )
HIWORD(v41) = *(&stru_140C23628 + 206) >> 8;
v14 = &UserData.12;
v15 = 6i64;
v16 = &v40;
do
{
*(_QWORD *)&v14[-3].Reserved = v16;
v16 = (__int128 *)((char *)v16 + 4);
*(_QWORD *)&v14[-1].Reserved = 4i64;
v14 += 4;
--v15;
}
while( v15 );
v17 = (const _EVENT_DESCRIPTOR *)POP_ETW_EVENT_PERFTRACK_HYBRID_RESUME;
return EtwWrite(PopDiagHandle, v17, 0, 6u, &UserData);
}
UserData.Ptr = (unsigned __int64)&v32;
v43 = &v38;
*(_QWORD *)&UserData.Size = 4i64;
v45 = &v33;
v44 = 4i64;
v46 = 4i64;
result = EtwWrite(PopDiagHandle, &POP_ETW_EVENT_PERFTRACK_HIBERNATE, 0, 3u, &UserData);
v18 = *(&stru_140C23628 + 120);
if( *(&stru_140C23628 + 120) )
{
PopComputeDerivedHiberStats((unsigned __int64 *)&stru_140C23628 + 50, v4, (__int64)&v39);
LODWORD(v40) = v29;
v19 = *(&stru_140C23628 + 106) >> 8;
if( *(&stru_140C23628 + 106) >> 8 > 0x7FFFui64 )
LOWORD(v19) = 0x7FFF;
WORD2(v40) = (v3 << 10) ^ (v19 ^ (v3 << 10)) & 0x7FFF;
WORD3(v40) = *(&stru_140C23628 + 214) >> 8;
if( *(&stru_140C23628 + 107) >> 8 >= 0xFFFFui64 )
WORD3(v40) = -1;
WORD4(v40) = *(&stru_140C23628 + 62) / v4;
if( *(&stru_140C23628 + 62) / v4 >= 0xFFFF )
WORD4(v40) = -1;
WORD5(v40) = *(&stru_140C23628 + 92) / v4;
if( *(&stru_140C23628 + 92) / v4 >= 0xFFFF )
WORD5(v40) = -1;
WORD6(v40) = v18;
if( v18 >= 0xFFFF )
WORD6(v40) = -1;
HIWORD(v40) = *(&stru_140C23628 + 400);
if( *(&stru_140C23628 + 200) >= 0xFFFFu )
HIWORD(v40) = -1;
v20 = DWORD1(v39);
if( DWORD1(v39) > 0x3FF )
v20 = 1023;
v21 = HIDWORD(v39);
if( HIDWORD(v39) > 0x1FF )
v21 = 511;
v22 = v20 ^ (v20 ^ (v21 << 10)) & 0x7FC00;
v23 = (*(&stru_140C23628 + 78) - *(&stru_140C23628 + 85)) / v4;
if( v23 > 0x1FFF )
LODWORD(v23) = 0x1FFF;
LODWORD(v41) = v22 & 0x7FFFF | ((_DWORD)v23 << 19);
v24 = *(&stru_140C23628 + 102) >> 8;
if( *(&stru_140C23628 + 102) >> 8 > 0x7FFFui64 )
LOWORD(v24) = 0x7FFF;
if( *(&stru_140C23628 + 706) )
v25 = 0x8000;
else
v25 = 0;
WORD2(v41) = v25 | v24 & 0x7FFF;
HIWORD(v41) = *(&stru_140C23628 + 206) >> 8;
if( *(&stru_140C23628 + 103) >> 8 >= 0xFFFFui64 )
HIWORD(v41) = -1;
v26 = &UserData.12;
v27 = 6i64;
v28 = &v40;
do
{
*(_QWORD *)&v26[-3].Reserved = v28;
v28 = (__int128 *)((char *)v28 + 4);
*(_QWORD *)&v26[-1].Reserved = 4i64;
v26 += 4;
--v27;
}
while( v27 );
v17 = &POP_ETW_EVENT_PERFTRACK_RESUME_FROM_HIBERNATE;
return EtwWrite(PopDiagHandle, v17, 0, 6u, &UserData);
}
}
}
}
return result;
}Referenced by:
PopIssueActionRequest