PopRecordPoIrpBlackboxInformation

VOID __stdcall PopRecordPoIrpBlackboxInformation(){
  UINT64 v0; 
  __int64 v1; 
  int v2; 
  _DWORD *v3; 
  UINT64 v4; 
  unsigned __int64 v5; 
  __int64 v6; 
  _DWORD *PoolWithTag; 
  ULONG_PTR v8; 
  char *v9; 
  __int64 i; 
  __int64 v11; 
  UINT64 v12; 
  __int64 v13; 
  UINT64 OutputBufferLength; 
  struct _KLOCK_QUEUE_HANDLE LockHandle; 
  __int64 InputBuffer; 
  __int128 InputBuffer_8; 
  __int128 v18; 
  __int16 Src[64]; 
  InputBuffer_8 = 0i64;
  InputBuffer = 0i64;
  v18 = 0i64;
  *(_OWORD *)&LockHandle.LockQueue.Lock = 0i64;
  KeAcquireInStackQueuedSpinLock(&PopIrpLock, (KLOCK_QUEUE_HANDLE *)&LockHandle.LockQueue.Lock);
  v1 = PopIrpList;
  v2 = 0;
  v3 = 0i64;
  v4 = 64i64;
  if( (__int64 *)PopIrpList == &PopIrpList )
    goto LABEL_22;
  do
  {
    if( *(_BYTE *)(v1 + 196) )
    {
      v5 = 24i64;
      if( PopDiagGetDriverName(*(DEVICE_OBJECT **)(v1 + 32), (PWCHAR)Src, v0) >= 0 )
      {
        v6 = -1i64;
        do
          ++v6;
        while( Src[v6] );
        v5 = 2 * v6 + 26;
        if( v5 < 0x18 )
          goto LABEL_22;
      }
      ++v2;
      if( v4 + v5 < v4 )
        goto LABEL_22;
      v4 += v5;
    }
    v1 = *(_QWORD *)v1;
  }
  while( (__int64 *)v1 != &PopIrpList );
  if( !v2 )
  {
LABEL_22:
    v4 = 0i64;
  }
  else
  {
    PoolWithTag = ExAllocatePoolWithTag(NonPagedPoolNx, v4, 0x42424F50ui64);
    v3 = PoolWithTag;
    if( PoolWithTag )
    {
      memset((INT64)PoolWithTag, 0i64);
      v3[2] = v2;
      *((_QWORD *)v3 + 3) = &PopIrpThreadList;
      v8 = ExWorkerQueue;
      *((_QWORD *)v3 + 2) = &PopIrpList;
      v9 = (char *)(v3 + 10);
      *((_QWORD *)v3 + 4) = v8;
      v3[1] = 1;
      *v3 = v4;
      for( i = PopIrpList; (__int64 *)i != &PopIrpList; i = *(_QWORD *)i )
      {
        if( *(_BYTE *)(i + 196) )
        {
          *((_DWORD *)v9 + 2) = *(unsigned __int8 *)(i + 184);
          *((_DWORD *)v9 + 3) = *(_DWORD *)(i + 188);
          *((_DWORD *)v9 + 4) = *(_DWORD *)(i + 192);
          v11 = 24i64;
          *((_DWORD *)v9 + 1) = (KiQueryUnbiasedInterruptTime(1u) - *(_QWORD *)(i + 48)) / 0x2710;
          if( PopDiagGetDriverName(*(DEVICE_OBJECT **)(i + 32), (PWCHAR)Src, v12) >= 0 )
          {
            v13 = -1i64;
            do
              ++v13;
            while( Src[v13] );
            v11 = 2 * v13 + 26;
            memmove((UINT8 *)v9 + 20, (UINT8 *)Src, 2 * v13);
            *(_WORD *)&v9[2 * v13 + 20] = 0;
          }
          *(_DWORD *)v9 = v11;
          v9 += v11;
        }
      }
    }
  }
  KeReleaseInStackQueuedSpinLockFromDpcLevel((_KLOCK_QUEUE_HANDLE *)&LockHandle.LockQueue.Lock);
  __writecr8((unsigned __int8)InputBuffer);
  if( v4 )
  {
    *(_QWORD *)&v18 = 0i64;
    *((_QWORD *)&v18 + 1) = 4i64;
    *(_QWORD *)&InputBuffer_8 = v3;
    *((_QWORD *)&InputBuffer_8 + 1) = (unsigned int)v4;
    LODWORD(OutputBufferLength) = 0;
    NtPowerInformation(TraceApplicationPowerMessage|0x40, &InputBuffer_8, 0x20ui64, 0i64, OutputBufferLength);
  }
  if( v3 )
    ExFreePoolWithTag(v3, 0x42424F50u);
}

Referenced by: