PopDiagTraceSessionStates
VOID __fastcall PopDiagTraceSessionStates(PCEVENT_DESCRIPTOR EventDescriptor, INT64 a2, INT64 a3){
REGHANDLE v4;
_EVENT_DATA_DESCRIPTOR UserData;
int *v6;
int v7;
int v8;
int v9;
int v10;
v10 = a3;
v9 = a2;
if( PopDiagHandleRegistered )
{
v4 = PopDiagHandle;
if( EtwEventEnabled(PopDiagHandle, EventDescriptor) )
{
UserData.Reserved = 0;
v8 = 0;
UserData.Ptr = (unsigned __int64)&v9;
UserData.Size = 4;
v6 = &v10;
v7 = 4;
EtwWrite(v4, EventDescriptor, 0, 2u, &UserData);
}
}
}Referenced by:
NtPowerInformation
PopSessionConnected
PopSessionDisconnected
PopSessionInputChange
PopSessionWinlogonNotification
PopSetSessionDisplayStatus
PopSetSessionUserStatus