PopDiagTraceTripPointExceeded

char __fastcall PopDiagTraceTripPointExceeded(unsigned __int16 a1, __int64 a2, int a3, const _EVENT_DESCRIPTOR *a4){
  void **v4; 
  int v7; 
  __int64 v9; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  __int64 v11; 
  int v12; 
  int v13; 
  __int64 *v14; 
  int v15; 
  int v16; 
  int *v17; 
  int v18; 
  int v19; 
  void *retaddr; 
  unsigned __int16 v21; 
  int v22; 

  v4 = &retaddr;
  v22 = a3;
  v21 = a1;
  v7 = a1;
  if( PopDiagHandleRegistered )
  {
    LOBYTE(v4) = EtwEventEnabled(PopDiagHandle, a4);
    if( (_BYTE)v4 )
    {
      UserData.Reserved = 0;
      v13 = 0;
      UserData.Ptr = (unsigned __int64)&v21;
      UserData.Size = 2;
      v11 = a2;
      v12 = 2 * v7;
      v16 = 0;
      v19 = 0;
      v9 = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
      v14 = &v9;
      v17 = &v22;
      v15 = 8;
      v18 = 4;
      LOBYTE(v4) = EtwWrite(PopDiagHandle, a4, 0, 4u, &UserData);
    }
  }
  return(char)v4;
}

Referenced by:

PopDiagTraceUsermodeTripPointExceeded
PopDiagTraceZoneCriticalTripPointExceeded
PopDiagTraceZoneS4TripPointExceeded