PopDiagTraceAppPowerMessage

void __fastcall PopDiagTraceAppPowerMessage(HANDLE *a1, __int64 a2, EVENT_DESCRIPTOR *a3){
  NTSTATUS v4; 
  _EPROCESS *v5; 
  unsigned __int16 *v6; 
  int v7; 
  __int16 v8; 
  int v9; 
  _EPROCESS *Process; 
  EVENT_DATA_DESCRIPTOR UserData; 
  __int16 *v12; 
  __int64 v13; 
  __int64 v14; 
  int v15; 
  int v16; 
  v8 = 0;
  v9 = 0;
  Process = 0i64;
  if( PopDiagHandleRegistered && EtwEventEnabled(PopDiagHandle, (EVENT_DESCRIPTOR *)&POP_ETW_EVENT_SUSPENDAPP, a3) )
  {
    v4 = PsLookupProcessByProcessId(*a1, (PEPROCESS *)&Process);
    v5 = Process;
    if( v4 >= 0 )
    {
      v6 = (unsigned __int16 *)*((_QWORD *)Process + 184);
      v9 = *(_DWORD *)a1;
      v8 = *v6 >> 1;
      UserData.Ptr = (unsigned __int64)&v9;
      v12 = &v8;
      *(_QWORD *)&UserData.Size = 4i64;
      v13 = 2i64;
      v7 = *v6;
      v14 = *((_QWORD *)v6 + 1);
      v15 = v7;
      v16 = 0;
      EtwWrite(PopDiagHandle, (EVENT_DESCRIPTOR *)&POP_ETW_EVENT_SUSPENDAPP, 0i64, 3ui64, &UserData);
    }
    if( v5 )
      ObfDereferenceObjectWithTag(v5, 0x746C6644ui64);
  }
}

Referenced by: