PoDiagTraceDeviceRundown
VOID __stdcall PoDiagTraceDeviceRundown(
_DEVICE_NODE *DevNode,
_UNICODE_STRING *InstancePath,
_UNICODE_STRING *FriendlyName,
_DEVICE_POWER_STATE PowerState){
int Length;
unsigned __int16 v5;
int v6;
ULONG v7;
char v8;
__int16 v9;
__int16 v10;
_EVENT_DATA_DESCRIPTOR UserData;
char *v12;
__int64 v13;
__int16 *v14;
__int64 v15;
wchar_t *Buffer;
int v17;
int v18;
__int16 *v19;
__int64 v20;
wchar_t *v21;
int v22;
int v23;
_DEVICE_NODE *v24;
v24 = DevNode;
Length = InstancePath->Length;
UserData.Ptr = (unsigned __int64)&v24;
v17 = Length;
v12 = &v8;
v5 = Length;
v8 = PowerState - 1;
v6 = FriendlyName->Length;
v7 = 5;
v9 = v5 >> 1;
v14 = &v9;
Buffer = InstancePath->Buffer;
v10 = (unsigned __int16)v6 >> 1;
v19 = &v10;
*(_QWORD *)&UserData.Size = 8i64;
v13 = 1i64;
v15 = 2i64;
v18 = 0;
v20 = 2i64;
if( (_WORD)v6 )
{
v7 = 6;
v21 = FriendlyName->Buffer;
v22 = v6;
v23 = 0;
}
EtwWrite(PopDiagHandle, &POP_ETW_EVENT_DEVICE_RUNDOWN, 0, v7, &UserData);
}Referenced by:
PopDiagDeviceRundownWorker