PpmEventProcessorVetoRundown

void __fastcall PpmEventProcessorVetoRundown(__int64 a1, __int64 a2, EVENT_DESCRIPTOR *a3){
  __int64 v3; 
  unsigned int v5; 
  __int16 v6; 
  UINT64 v7; 
  __int16 v8; 
  unsigned int v9; 
  unsigned __int8 v10; 
  unsigned __int64 v11; 
  __int64 v12; 
  _QWORD **v13; 
  _QWORD *v14; 
  UINT64 UserDataCount; 
  unsigned int i; 
  __int16 v17; 
  int v18[2]; 
  EVENT_DATA_DESCRIPTOR UserData; 
  __int64 v20; 
  int v21; 
  int v22; 
  int *p_i; 
  int v24; 
  int v25; 
  _QWORD *v26; 
  int v27; 
  int v28; 
  __int64 v29; 
  int v30; 
  int v31; 
  v3 = *(_QWORD *)(a1 + 0x8000);
  memset(v18, 0, 7);
  if( v3 )
  {
    v5 = 1;
    for( i = 1; v5 < *(_DWORD *)(v3 + 32); i = v5 )
    {
      v6 = *(unsigned __int8 *)(a1 + 208);
      UserData.Reserved = 0;
      LOWORD(v18[0]) = v6;
      BYTE2(v18[0]) = *(_BYTE *)(a1 + 209);
      *(int *)((char *)v18 + 3) = v5;
      UserData.Ptr = (unsigned __int64)v18;
      UserData.Size = 7;
      PpmEventTracePreVetoAccounting(
        (EVENT_DESCRIPTOR *)&PPM_ETW_PROCESSOR_PRE_VETO_ACCOUNTING_RUNDOWN,
        &UserData,
        248i64 * v5 + v3 + 1016);
      v5 = i + 1;
    }
    if( PpmEtwRegistered && EtwEventEnabled(PpmEtwHandle, (EVENT_DESCRIPTOR *)&PPM_ETW_PROCESSOR_IDLE_VETO_RUNDOWN, a3) )
    {
      v8 = *(unsigned __int8 *)(a1 + 208);
      UserData.Reserved = 0;
      v22 = 0;
      v17 = v8;
      UserData.Ptr = (unsigned __int64)&v17;
      v20 = a1 + 209;
      UserData.Size = 2;
      v21 = 1;
      KeAcquireSpinLockRaiseToDpc(&PpmIdleVetoLock, v7);
      v9 = 0;
      v11 = v10;
      i = 0;
      if( *(_DWORD *)(v3 + 32) )
      {
        v12 = 0i64;
        do
        {
          v25 = 0;
          p_i = (int *)&i;
          v24 = 4;
          v13 = (_QWORD **)(248 * v12 + v3 + 1024);
          v14 = *v13;
          if( *v13 != v13 )
          {
            do
            {
              v28 = 0;
              v31 = 0;
              v26 = v14 + 2;
              v27 = 4;
              v29 = (__int64)v14 + 20;
              LODWORD(UserDataCount) = 5;
              v30 = 4;
              EtwWriteEx(
                PpmEtwHandle,
                (EVENT_DESCRIPTOR *)&PPM_ETW_PROCESSOR_IDLE_VETO_RUNDOWN,
                0i64,
                0i64,
                0i64,
                0i64,
                UserDataCount,
                &UserData);
              v14 = (_QWORD *)*v14;
            }
            while( v14 != v13 );
            v9 = i;
          }
          i = ++v9;
          v12 = v9;
        }
        while( v9 < *(_DWORD *)(v3 + 32) );
      }
      KxReleaseSpinLock(&PpmIdleVetoLock);
      __writecr8(v11);
    }
  }
}

Referenced by: