PpmEventTraceProcessorPerformanceDomainRundown

VOID __fastcall PpmEventTraceProcessorPerformanceDomainRundown(INT64 a1, INT64 a2, EVENT_DESCRIPTOR *a3){
  _DWORD *PoolWithTag; 
  unsigned __int16 v5; 
  USHORT i; 
  _GROUP_AFFINITY *v7; 
  bool v8; 
  unsigned int v9; 
  _OWORD *v10; 
  __int64 v11; 
  __int64 v12; 
  __int64 v13; 
  unsigned int v14; 
  unsigned __int16 v15; 
  __int64 v16; 
  __int64 v17; 
  unsigned int v18; 
  __int64 v19; 
  unsigned int v20; 
  unsigned __int16 j; 
  __int64 v22; 
  __int64 v23; 
  __int64 v24; 
  __int64 v25; 
  unsigned int v26; 
  unsigned __int16 v27; 
  int v28; 
  EVENT_DATA_DESCRIPTOR UserData[42]; 
  _OWORD v30[20]; 
  PoolWithTag = 0i64;
  if( PpmEtwRegistered && EtwEventEnabled(PpmEtwHandle, (EVENT_DESCRIPTOR *)&PPM_ETW_PERF_DOMAIN_RUNDOWN, a3) )
  {
    v5 = 0;
    v27 = 0;
    for( i = 0; i < 0x14u; ++i )
    {
      v7 = (_GROUP_AFFINITY *)&v30[v5];
      *v7 = 0i64;
      v7->Group = i;
      v7->Mask = KeQueryGroupAffinity(i);
      v8 = (unsigned int)KeAndGroupAffinityEx((_KAFFINITY_EX *)(a1 + 24), v7, v7) == 0;
      v5 = v27;
      if( !v8 )
        v5 = ++v27;
    }
    UserData[0].Ptr = (unsigned __int64)&v27;
    v9 = 1;
    *(_QWORD *)&UserData[0].Size = 2i64;
    if( v5 )
    {
      v10 = v30;
      v11 = v5;
      do
      {
        v12 = v9;
        UserData[v12].Ptr = (unsigned __int64)v10 + 8;
        *(_QWORD *)&UserData[v12].Size = 2i64;
        v13 = v9 + 1;
        v9 += 2;
        UserData[v13].Ptr = (unsigned __int64)v10++;
        *(_QWORD *)&UserData[v13].Size = 8i64;
        --v11;
      }
      while( v11 );
    }
    v14 = *(_DWORD *)(a1 + 200);
    v15 = 0;
    v16 = v9;
    v17 = 0i64;
    v18 = v9 + 1;
    v28 = 0;
    UserData[v16].Ptr = (unsigned __int64)&v28;
    *(_QWORD *)&UserData[v16].Size = 4i64;
    if( v14 )
    {
      v19 = *(_QWORD *)(a1 + 216);
      do
      {
        if( *(_DWORD *)(136i64 * v15 + v19 + 16) == 1 )
        {
          v17 = (unsigned int)(v17 + 1);
          v28 = v17;
        }
        ++v15;
      }
      while( v15 < v14 );
      if( (_DWORD)v17 )
      {
        PoolWithTag = ExAllocatePoolWithTag(PagedPool, 4 * v17, 0x654D5050ui64);
        if( !PoolWithTag )
          return;
        v20 = 0;
        for( j = 0; (unsigned int)j < *(_DWORD *)(a1 + 200); ++j )
        {
          v22 = *(_QWORD *)(a1 + 216);
          v23 = 136i64 * j;
          if( *(_DWORD *)(v23 + v22 + 16) == 1 )
          {
            v24 = v20++;
            PoolWithTag[v24] = *(_DWORD *)(v23 + v22 + 20);
          }
        }
        v25 = v18;
        v26 = 4 * v28;
        ++v18;
        UserData[v25].Ptr = (unsigned __int64)PoolWithTag;
        UserData[v25].Size = v26;
        UserData[v25].Reserved = 0;
      }
    }
    EtwWrite(PpmEtwHandle, (EVENT_DESCRIPTOR *)&PPM_ETW_PERF_DOMAIN_RUNDOWN, 0i64, v18, UserData);
    if( PoolWithTag )
      ExFreePoolWithTag(PoolWithTag, 0x654D5050u);
  }
}

Referenced by: