PopDiagTraceFxComponentAccounting
void __fastcall PopDiagTraceFxComponentAccounting(__int64 a1, int a2, __int64 a3, unsigned __int16 *a4, char a5){
WCHAR v7;
EVENT_DESCRIPTOR *v8;
UINT64 v9;
_DEVICE_OBJECT *v10;
bool v11;
int DevicePropertyString;
wchar_t *Buffer;
bool v14;
wchar_t *v15;
int v16;
__int64 v17;
char v18;
int v19;
__int64 v20;
struct _UNICODE_STRING DestinationString;
struct _UNICODE_STRING v22;
UINT64 v23;
__int64 v24;
__int64 v25;
EVENT_DATA_DESCRIPTOR UserData;
__int64 *v27;
__int64 v28;
int *v29;
__int64 v30;
char *v31;
__int64 v32;
UINT64 *v33;
__int64 v34;
struct _EVENT_DATA_DESCRIPTOR v35;
UINT64 *v36;
__int64 v37;
int *v38;
__int64 v39;
__int64 v40;
int v41[2];
int *v42;
__int64 v43;
__int64 *v44;
__int64 v45;
__int64 v46;
__int64 v47;
__int64 v48;
__int64 v49;
__int64 *v50;
__int64 v51;
int *v52;
__int64 v53;
wchar_t *v54;
int v55[2];
int *v56;
__int64 v57;
wchar_t *v58;
int v59[2];
int *v60;
__int64 v61;
__int64 v62;
int v63[2];
int v64;
v64 = a2;
v20 = a1;
DestinationString = 0i64;
v22 = 0i64;
RtlInitUnicodeString(&DestinationString, &word_1407CF120, a3);
RtlInitUnicodeString(&v22, &word_1407CF120, v7);
if( PopDiagHandleRegistered )
{
v9 = PopDiagHandle;
if( EtwEventEnabled(PopDiagHandle, (EVENT_DESCRIPTOR *)&POP_ETW_EVENT_COMPONENT_ACCOUNTING, v8) )
{
v18 = PopWnfCsEnterScenarioId;
*(_QWORD *)&UserData.Size = 1i64;
UserData.Ptr = (unsigned __int64)&v18;
v28 = 8i64;
v27 = &v20;
v30 = 4i64;
v29 = &v64;
v32 = 8i64;
v31 = &a5;
v34 = 8i64;
v33 = &PopWnfCsEnterScenarioId;
EtwWrite(v9, (EVENT_DESCRIPTOR *)&POP_ETW_EVENT_COMPONENT_ACCOUNTING, 0i64, 5ui64, &UserData);
if( *(_DWORD *)(a3 + 12) != -1 && !PopDiagFxAccountingTelemetryDisabled )
{
v10 = *(_DEVICE_OBJECT **)(v20 + 32);
v11 = (int)PopDiagQueryDevicePropertyString(v10, DevicePropertyClassName, (__int64)&DestinationString) >= 0;
DevicePropertyString = PopDiagQueryDevicePropertyString(v10, DevicePropertyClassGuid, (__int64)&v22);
Buffer = DestinationString.Buffer;
v14 = DevicePropertyString >= 0;
v15 = v22.Buffer;
if( (unsigned int)dword_140C021E8 > 5 && tlgKeywordOn((__int64)&dword_140C021E8, 0x400000000000i64) )
{
v23 = PopWnfCsEnterScenarioId;
v37 = 8i64;
v36 = &v23;
v16 = *(unsigned __int16 *)(v20 + 40);
v17 = *(_QWORD *)(v20 + 48);
v38 = v41;
v19 = v64;
v42 = &v19;
v24 = *(_QWORD *)(a3 + 32);
v44 = &v24;
v46 = a3 + 48;
v48 = a3 + 88;
v25 = *(_QWORD *)(a3 + 40);
v50 = &v25;
v52 = v55;
v55[0] = DestinationString.Length;
v56 = v59;
v59[0] = v22.Length;
v60 = v63;
v62 = *((_QWORD *)a4 + 1);
v63[0] = *a4;
v40 = v17;
v41[0] = v16;
v39 = 2i64;
v41[1] = 0;
v43 = 4i64;
v45 = 8i64;
v47 = 40i64;
v49 = 40i64;
v51 = 8i64;
v53 = 2i64;
v54 = Buffer;
v55[1] = 0;
v57 = 2i64;
v58 = v15;
v59[1] = 0;
v61 = 2i64;
v63[1] = 0;
tlgWriteTransfer_EtwWriteTransfer(
(__int64)&dword_140C021E8,
(unsigned __int8 *)&dword_14002762C,
0i64,
0i64,
0x10u,
&v35);
}
if( v11 )
ExFreePoolWithTag(Buffer, 0x67696450u);
if( v14 )
ExFreePoolWithTag(v15, 0x67696450u);
}
}
}
}Referenced by:
PopFxStopDeviceAccounting