PopTraceThermalZoneActiveActivity

CHAR __fastcall PopTraceThermalZoneActiveActivity(INT64 a1){
  DEVICE_OBJECT *v2; 
  DEVICE_OBJECT *DeviceAttachmentBaseRefWithTag; 
  DEVICE_OBJECT *v4; 
  __int64 v5; 
  const WCHAR *v6; 
  int v7; 
  int v8; 
  _WORD a3[2]; 
  int a2; 
  __int64 v12; 
  struct _EVENT_DATA_DESCRIPTOR v13; 
  int *v14; 
  int v15; 
  int v16; 
  __int64 v17; 
  int v18[2]; 
  char v19[16]; 
  int *p_a2; 
  int v21; 
  int v22; 
  _BYTE *v23; 
  int v24; 
  int v25; 
  INT64 *v26; 
  int v27; 
  int v28; 
  __int64 *v29; 
  int v30; 
  int v31; 
  INT64 a4[5]; 
  a2 = 0;
  v2 = *(DEVICE_OBJECT **)(a1 + 48);
  LOBYTE(a3[0]) = 0;
  DeviceAttachmentBaseRefWithTag = IoGetDeviceAttachmentBaseRefWithTag(v2, 0x67446F50ui64);
  v4 = DeviceAttachmentBaseRefWithTag;
  if( DeviceAttachmentBaseRefWithTag )
    v5 = *(_QWORD *)(*((_QWORD *)DeviceAttachmentBaseRefWithTag + 39) + 40i64);
  else
    v5 = 0i64;
  if( v5 )
  {
    LOBYTE(DeviceAttachmentBaseRefWithTag) = PopDiagSnapActiveActivity(a1 + 504, &a2, a3, (INT64)a4);
    if( a2 )
    {
      if( (_BYTE)DeviceAttachmentBaseRefWithTag || PopThermalTelemetryVerbosity )
      {
        DeviceAttachmentBaseRefWithTag = *(DEVICE_OBJECT **)(a1 + 1048);
        if( (unsigned int)dword_140C021E8 > 5 )
        {
          LOBYTE(DeviceAttachmentBaseRefWithTag) = tlgKeywordOn((__int64)&dword_140C021E8, 0x400000000000i64);
          if( (_BYTE)DeviceAttachmentBaseRefWithTag )
          {
            v16 = 0;
            v18[1] = 0;
            v14 = v18;
            v17 = *(_QWORD *)(v5 + 136);
            v18[0] = *(unsigned __int16 *)(v5 + 128);
            v15 = 2;
            tlgCreate1Sz_wchar_t((__int64)v19, v6);
            v22 = 0;
            v25 = 0;
            v28 = 0;
            v31 = 0;
            p_a2 = &a2;
            a3[0] = LOBYTE(a3[0]);
            v27 = 4 * LOBYTE(a3[0]);
            v23 = a3;
            v29 = &v12;
            v26 = a4;
            a2 = v7;
            v21 = 4;
            v24 = v8;
            v12 = 0x1000000i64;
            v30 = 8;
            LOBYTE(DeviceAttachmentBaseRefWithTag) = tlgWriteTransfer_EtwWriteTransfer(
                                                       (__int64)&dword_140C021E8,
                                                       (unsigned __int8 *)&byte_140027077,
                                                       0i64,
                                                       0i64,
                                                       9u,
                                                       &v13);
          }
        }
      }
    }
  }
  if( v4 )
    LOBYTE(DeviceAttachmentBaseRefWithTag) = ObfDereferenceObjectWithTag(v4, 0x67446F50ui64);
  return(char)DeviceAttachmentBaseRefWithTag;
}

Referenced by:

PopThermalSxEntry
PopThermalTelemetryWorker
PopThermalZoneRemove