PopDiagTraceHiberStats

VOID __stdcall PopDiagTraceHiberStats(){
  NTSTATUS v0; 
  PVOID v1; 
  UINT64 v2; 
  unsigned __int64 v3; 
  EVENT_DESCRIPTOR *v4; 
  __int64 v5; 
  char *v6; 
  $AC492906E908F75CD234F2140A5AAD56 *v7; 
  char *Data; 
  __int64 *v9; 
  __int64 v10; 
  char *v11; 
  unsigned __int64 v12; 
  int v13; 
  int v14; 
  WCHAR v15; 
  WCHAR v16; 
  WCHAR v17; 
  UINT64 v18; 
  UINT64 DataSize; 
  UINT64 DataSizeb; 
  UINT64 DataSizea; 
  PVOID DestinationString[3]; 
  __int64 v23; 
  INT64 v24; 
  __int128 v25; 
  char v26[384]; 
  struct _EVENT_DATA_DESCRIPTOR UserData; 
  v25 = 0i64;
  memset(DestinationString, 0, sizeof(DestinationString));
  v0 = PopOpenPowerKey(DestinationString);
  v1 = DestinationString[0];
  if( v0 < 0 )
    v1 = 0i64;
  DestinationString[0] = v1;
  v2 = PopCaptureTimeOnProcZero();
  v3 = qword_140C23890;
  qword_140C238D0 -= qword_140C238B8 + qword_140C238B0;
  qword_140C23898 = v2 - (qword_140C238B8 + qword_140C238B0);
  dword_140C2399C = dword_140C23484;
  dword_140C23998 = dword_140C23508;
  v24 = qword_140C23890;
  LODWORD(qword_140C23948) = PopQpcTimeInMs(&stru_140C23778, &stru_140C23780);
  qword_140C237F8 = (unsigned int)PopQpcTimeInMs(&StartTime, &stru_140C23800);
  PopComputeDerivedHiberStats(&qword_140C237B8, v3, (INT64)&v25);
  v5 = 47i64;
  v6 = v26;
  v23 = 47i64;
  v7 = &UserData.12;
  Data = v26;
  v9 = &qword_140988950;
  do
  {
    v10 = *(v9 - 1);
    if( (*(_DWORD *)v9 & 0x40000000) != 0 )
      v11 = &v26[v10 - 8];
    else
      v11 = (char *)&qword_140C237B8 + v10;
    if( (*(_DWORD *)v9 & 2) != 0 )
      v12 = *(_QWORD *)v11;
    else
      v12 = *(unsigned int *)v11;
    *(_QWORD *)v6 = v12;
    v13 = *(_DWORD *)v9;
    if( *(int *)v9 < 0 )
    {
      v5 = v23;
      *(_QWORD *)v6 = v12 / v3;
    }
    v14 = v13 & 0x20;
    if( v1 )
    {
      RtlInitUnicodeString((PUNICODE_STRING)&DestinationString[1], (PCWSTR)*(v9 - 2), (WCHAR)v4);
      LODWORD(DataSize) = v14 != 0 ? 8 : 4;
      ZwSetValueKey(v1, (UNICODE_STRING *)&DestinationString[1], 0i64, v14 != 0 ? 11 : 4, Data, DataSize);
      v5 = v23;
    }
    *(_QWORD *)&v7[-3].Reserved = Data;
    v7[-1].Reserved = v14 != 0 ? 8 : 4;
    Data += 8;
    v3 = v24;
    v9 += 3;
    v7->Reserved = 0;
    v6 += 8;
    v7 += 4;
    v23 = --v5;
  }
  while( v5 );
  qword_140C23910 /= v3;
  qword_140C237C0 /= v3;
  qword_140C239A0 = qword_140C23898 / v3 - (unsigned int)qword_140C23808 - (unsigned int)dword_140C23810;
  if( v1 )
  {
    RtlInitUnicodeString((PUNICODE_STRING)&DestinationString[1], L"KernelResumeIoCpuTime", (WCHAR)v4);
    LODWORD(DataSize) = 4;
    ZwSetValueKey(v1, (UNICODE_STRING *)&DestinationString[1], 0i64, 4ui64, &qword_140C23910, DataSize);
    RtlInitUnicodeString((PUNICODE_STRING)&DestinationString[1], L"HiberIoCpuTime", v15);
    LODWORD(DataSizeb) = 4;
    ZwSetValueKey(v1, (UNICODE_STRING *)&DestinationString[1], 0i64, 4ui64, &qword_140C237C0, DataSizeb);
    if( stru_140C23938.QuadPart )
    {
      dword_140C23464 += PopQpcTimeInMs(&stru_140C23768, &stru_140C23940);
      RtlInitUnicodeString((PUNICODE_STRING)&DestinationString[1], L"HybridBootAnimationTime", v17);
      LODWORD(DataSizea) = 4;
      ZwSetValueKey(v1, (UNICODE_STRING *)&DestinationString[1], 0i64, 4ui64, &dword_140C23464, DataSizea);
    }
    qword_140C239A8 = (((unsigned __int64)KUSER_SHARED_DATA.TickCountMultiplier << 32)
                     * (unsigned __int128)(KUSER_SHARED_DATA.TickCountQuad << 8)) >> 64;
    RtlInitUnicodeString((PUNICODE_STRING)&DestinationString[1], L"ResumeCompleteTimestamp", v16);
    LODWORD(DataSizea) = 8;
    ZwSetValueKey(
      DestinationString[0],
      (UNICODE_STRING *)&DestinationString[1],
      0i64,
      0xBui64,
      &qword_140C239A8,
      DataSizea);
    ZwClose(DestinationString[0]);
  }
  if( PopDiagHandleRegistered )
  {
    v18 = PopDiagHandle;
    if( EtwEventEnabled(PopDiagHandle, (EVENT_DESCRIPTOR *)&POP_ETW_EVENT_HIBER_STATS, v4) )
      EtwWrite(v18, (EVENT_DESCRIPTOR *)&POP_ETW_EVENT_HIBER_STATS, 0i64, 0x2Fui64, &UserData);
  }
}

Referenced by: