PopDiagTraceDeviceAcquireIrp
VOID __stdcall PopDiagTraceDeviceAcquireIrp(IRP *Irp, DEVICE_OBJECT *DeviceObject){
EVENT_DESCRIPTOR *v2;
UINT64 v4;
NTSTATUS v5;
__int16 *v6;
__int64 v7;
UINT64 UserDataCount;
DEVICE_OBJECT *v9;
EVENT_DATA_DESCRIPTOR UserData;
DEVICE_OBJECT **v11;
__int64 v12;
__int16 *v13;
int v14;
int v15;
__int16 DriverName[64];
IRP *v17;
v17 = Irp;
v9 = DeviceObject;
if( PopDiagHandleRegistered
&& EtwEventEnabled(PopDiagHandle, (EVENT_DESCRIPTOR *)&POP_ETW_EVENT_IRP_DRIVERACQUIRE, v2) )
{
v5 = PopDiagGetDriverName(DeviceObject, (PWCHAR)DriverName, v4);
*(_QWORD *)&UserData.Size = 8i64;
v12 = 8i64;
v6 = DriverName;
if( v5 < 0 )
v6 = (__int16 *)&ppszDestEnd;
UserData.Ptr = (unsigned __int64)&v17;
v11 = &v9;
v7 = -1i64;
v13 = v6;
do
++v7;
while( v6[v7] );
v14 = 2 * v7 + 2;
v15 = 0;
LODWORD(UserDataCount) = 3;
EtwWriteEx(
PopDiagHandle,
(EVENT_DESCRIPTOR *)&POP_ETW_EVENT_IRP_DRIVERACQUIRE,
0i64,
0i64,
0i64,
0i64,
UserDataCount,
&UserData);
}
}Referenced by:
PoDeviceAcquireIrp