PpmEventTracePreVetoAccounting

VOID __fastcall PpmEventTracePreVetoAccounting(
        PCEVENT_DESCRIPTOR EventDescriptor,
        _EVENT_DATA_DESCRIPTOR *a2,
        INT64 a3){
  unsigned int v6; 
  VOID **PoolWithTag; 
  unsigned __int64 v8; 
  __int64 v9; 
  __int64 v10; 
  __int64 v11; 
  __int64 v12; 
  __int64 v13; 
  int v14; 
  __int64 v15; 
  _EVENT_DATA_DESCRIPTOR v16; 
  unsigned int v17; 
  INT64 CurrentQpc; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  unsigned int *v20; 
  int v21; 
  int v22; 
  VOID **v23; 
  unsigned int v24; 
  int v25; 

  CurrentQpc = 0i64;
  if( PpmEtwRegistered )
  {
    if( EtwEventEnabled(PpmEtwHandle, EventDescriptor) )
    {
      if( a3 )
      {
        v6 = *(_DWORD *)(a3 + 28);
        if( v6 )
        {
          PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 20 * v6, 1699565648i64);
          if( PoolWithTag )
          {
            v8 = (unsigned __int8)KeAcquireSpinLockRaiseToDpc((UINT64 *)&stru_140C23628 + 122);
            LODWORD(v9) = RtlGetInterruptTimePrecise(&CurrentQpc);
            v10 = 0i64;
            v17 = 0;
            v11 = 0i64;
            v12 = v6;
            do
            {
              v13 = *(_QWORD *)(a3 + 32);
              v14 = *(_DWORD *)(v11 + v13 + 16);
              if( v14 )
              {
                *((_DWORD *)PoolWithTag + 5 * v10) = v14;
                *(VOID **)((char *)PoolWithTag + 20 * v17 + 4) = *(VOID **)(v11 + v13 + 24);
                *(VOID **)((char *)PoolWithTag + 20 * v17 + 12) = *(VOID **)(v11 + v13 + 40);
                v15 = *(_QWORD *)(v11 + v13 + 32);
                if( v15 )
                  *(VOID **)((char *)PoolWithTag + 20 * v17 + 12) = *(char **)((char *)PoolWithTag + 20 * v17 + 12)
                                                                  + v9
                                                                  - v15;
                v10 = ++v17;
              }
              v11 += 64i64;
              --v12;
            }
            while( v12 );
            KxReleaseSpinLock((UINT64 *)&stru_140C23628 + 122);
            __writecr8(v8);
            v16 = *a2;
            v22 = 0;
            v25 = 0;
            v20 = &v17;
            UserData = v16;
            v21 = 4;
            v23 = PoolWithTag;
            v24 = 20 * v17;
            EtwWriteEx(PpmEtwHandle, EventDescriptor, 0i64, 0, 0, 0, 3u, &UserData);
            ExFreePoolWithTag(PoolWithTag, 0x654D5050u);
          }
        }
      }
    }
  }
}

Referenced by: