PopDiagTracePerfTrackData
VOID __fastcall PopDiagTracePerfTrackData(VOID *a1, UINT8 *a2, ACL **a3, UINT8 *a4){
__int16 v4;
__int64 v5;
unsigned __int64 v6;
int v7;
int v8;
unsigned __int64 v9;
int v10;
int v11;
int v12;
unsigned __int64 v13;
int v14;
unsigned __int64 v15;
$AC492906E908F75CD234F2140A5AAD56 *v16;
__int64 v17;
__int128 *v18;
EVENT_DESCRIPTOR *v19;
unsigned int v20;
unsigned __int64 v21;
int v22;
int v23;
int v24;
unsigned __int64 v25;
unsigned __int64 v26;
__int16 v27;
$AC492906E908F75CD234F2140A5AAD56 *v28;
__int64 v29;
__int128 *v30;
int v31;
int v32;
int v33;
int v34;
int v35;
_LARGE_INTEGER StartTime;
int v37;
int v38;
int v39;
int v40;
INT64 v41[2];
__int128 v42;
__int64 v43;
EVENT_DATA_DESCRIPTOR UserData;
int *v45;
__int64 v46;
int *v47;
__int64 v48;
int *v49;
__int64 v50;
int *v51;
__int64 v52;
v4 = (__int16)a1;
StartTime.QuadPart = 0i64;
*(_OWORD *)v41 = 0i64;
v43 = 0i64;
v42 = 0i64;
if( PopDiagHandleRegistered
&& EtwEventEnabled(PopDiagHandle, (EVENT_DESCRIPTOR *)&POP_ETW_EVENT_TRANSITIONTIMES, (EVENT_DESCRIPTOR *)a3) )
{
KeGetPrcb(0i64);
v6 = 1000i64 * *(unsigned int *)(v5 + 68);
v38 = PopQpcTimeInMs(&stru_140C237A0, &stru_140C237A8);
v37 = PopQpcTimeInMs(&stru_140C23790, &stru_140C23798);
if( stru_140C23788.QuadPart )
{
StartTime.QuadPart = 0i64;
v33 = PopQpcTimeInMs(&StartTime, &stru_140C23788);
v31 = v33 + PopQpcTimeInMs(&stru_140C23768, &stru_140C23770);
*(_QWORD *)&UserData.Size = 4i64;
UserData.Ptr = (unsigned __int64)&qword_140C23948;
v45 = &v31;
v47 = &v33;
v49 = &v37;
v51 = &v38;
v46 = 4i64;
v48 = 4i64;
v50 = 4i64;
v52 = 4i64;
EtwWrite(PopDiagHandle, (EVENT_DESCRIPTOR *)POP_ETW_EVENT_PERFTRACK_STANDBY, 0i64, 5ui64, &UserData);
return;
}
if( dword_140C23990 )
{
v7 = qword_140C237F8;
v34 = (4 * dword_140C23990) & 0x3FFFFF;
v40 = qword_140C237F8;
v35 = qword_140C237D0 / v6;
v31 = qword_140C239A0;
if( (v4 & 8) != 0 )
{
if( !PopShutdownButtonPressTime.QuadPart )
return;
v32 = PopQpcTimeInMs(&PopShutdownButtonPressTime, &::StartTime) + v7;
if( (int)PopReadRegKeyValue(
(WCHAR *)L"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon",
(WCHAR *)L"LastLogOffEndTimePerfCounter",
8ui64,
0i64,
&StartTime) < 0 )
v8 = 0;
else
v8 = PopQpcTimeInMs(&StartTime, &stru_140C23800);
v39 = v8;
*(_QWORD *)&UserData.Size = 4i64;
UserData.Ptr = (unsigned __int64)&v34;
v46 = 4i64;
v45 = &v32;
v48 = 4i64;
v47 = &v35;
v49 = &v39;
v50 = 4i64;
EtwWrite(PopDiagHandle, (EVENT_DESCRIPTOR *)&POP_ETW_EVENT_PERFTRACK_HYBRID_SHUTDOWN, 0i64, 4ui64, &UserData);
PopComputeDerivedHiberStats(&qword_140C237B8, v6, (INT64)v41);
LODWORD(v42) = v31;
v9 = (unsigned __int64)qword_140C23978 >> 8;
WORD3(v42) = -1;
if( (unsigned __int64)qword_140C23978 >> 8 > 0x7FFF )
LOWORD(v9) = 0x7FFF;
WORD2(v42) = v9 & 0x7FFF;
if( (unsigned __int64)qword_140C23980 >> 8 <= 0xFFFF )
WORD3(v42) = (unsigned int)qword_140C23980 >> 8;
WORD4(v42) = -1;
if( qword_140C23818 / v6 <= 0xFFFF )
WORD4(v42) = qword_140C23818 / v6;
WORD5(v42) = -1;
if( qword_140C23908 / v6 <= 0xFFFF )
WORD5(v42) = qword_140C23908 / v6;
WORD6(v42) = -1;
if( (unsigned int)qword_140C23808 <= 0xFFFF )
WORD6(v42) = qword_140C23808;
HIWORD(v42) = -1;
if( (unsigned int)qword_140C23948 <= 0xFFFF )
HIWORD(v42) = qword_140C23948;
v10 = HIDWORD(v41[0]);
HIWORD(v43) = -1;
if( HIDWORD(v41[0]) > 0x3FF )
v10 = 1023;
v11 = HIDWORD(v41[1]);
if( HIDWORD(v41[1]) > 0x1FF )
v11 = 511;
v12 = v10 ^ (v10 ^ (v11 << 10)) & 0x7FC00;
v13 = (qword_140C23898 - qword_140C238D0) / v6;
if( v13 > 0x1FFF )
LODWORD(v13) = 0x1FFF;
v14 = ((_DWORD)v13 << 19) | v12 & 0x7FFFF;
v15 = (unsigned __int64)qword_140C23958 >> 8;
LODWORD(v43) = v14;
if( (unsigned __int64)qword_140C23958 >> 8 > 0x7FFF )
LOWORD(v15) = 0x7FFF;
WORD2(v43) = v15 & 0x7FFF;
if( (unsigned __int64)qword_140C23960 >> 8 <= 0xFFFF )
HIWORD(v43) = (unsigned int)qword_140C23960 >> 8;
v16 = &UserData.12;
v17 = 6i64;
v18 = &v42;
do
{
*(_QWORD *)&v16[-3].Reserved = v18;
v18 = (__int128 *)((char *)v18 + 4);
*(_QWORD *)&v16[-1].Reserved = 4i64;
v16 += 4;
--v17;
}
while( v17 );
v19 = (EVENT_DESCRIPTOR *)POP_ETW_EVENT_PERFTRACK_HYBRID_RESUME;
LABEL_66:
EtwWrite(PopDiagHandle, v19, 0i64, 6ui64, &UserData);
return;
}
UserData.Ptr = (unsigned __int64)&v34;
v45 = &v40;
*(_QWORD *)&UserData.Size = 4i64;
v47 = &v35;
v46 = 4i64;
v48 = 4i64;
EtwWrite(PopDiagHandle, (EVENT_DESCRIPTOR *)&POP_ETW_EVENT_PERFTRACK_HIBERNATE, 0i64, 3ui64, &UserData);
v20 = qword_140C23808;
if( (_DWORD)qword_140C23808 )
{
PopComputeDerivedHiberStats(&qword_140C237B8, v6, (INT64)v41);
LODWORD(v42) = v31;
v21 = (unsigned __int64)qword_140C23978 >> 8;
if( (unsigned __int64)qword_140C23978 >> 8 > 0x7FFF )
LOWORD(v21) = 0x7FFF;
WORD2(v42) = (v4 << 10) ^ (v21 ^ (v4 << 10)) & 0x7FFF;
WORD3(v42) = (unsigned int)qword_140C23980 >> 8;
if( (unsigned __int64)qword_140C23980 >> 8 >= 0xFFFF )
WORD3(v42) = -1;
WORD4(v42) = qword_140C23818 / v6;
if( qword_140C23818 / v6 >= 0xFFFF )
WORD4(v42) = -1;
WORD5(v42) = qword_140C23908 / v6;
if( qword_140C23908 / v6 >= 0xFFFF )
WORD5(v42) = -1;
WORD6(v42) = v20;
if( v20 >= 0xFFFF )
WORD6(v42) = -1;
HIWORD(v42) = qword_140C23948;
if( (unsigned int)qword_140C23948 >= 0xFFFF )
HIWORD(v42) = -1;
v22 = HIDWORD(v41[0]);
if( HIDWORD(v41[0]) > 0x3FF )
v22 = 1023;
v23 = HIDWORD(v41[1]);
if( HIDWORD(v41[1]) > 0x1FF )
v23 = 511;
v24 = v22 ^ (v22 ^ (v23 << 10)) & 0x7FC00;
v25 = (qword_140C23898 - qword_140C238D0) / v6;
if( v25 > 0x1FFF )
LODWORD(v25) = 0x1FFF;
LODWORD(v43) = v24 & 0x7FFFF | ((_DWORD)v25 << 19);
v26 = (unsigned __int64)qword_140C23958 >> 8;
if( (unsigned __int64)qword_140C23958 >> 8 > 0x7FFF )
LOWORD(v26) = 0x7FFF;
if( PopEnableMinimalHiberFile )
v27 = 0x8000;
else
v27 = 0;
WORD2(v43) = v27 | v26 & 0x7FFF;
HIWORD(v43) = (unsigned int)qword_140C23960 >> 8;
if( (unsigned __int64)qword_140C23960 >> 8 >= 0xFFFF )
HIWORD(v43) = -1;
v28 = &UserData.12;
v29 = 6i64;
v30 = &v42;
do
{
*(_QWORD *)&v28[-3].Reserved = v30;
v30 = (__int128 *)((char *)v30 + 4);
*(_QWORD *)&v28[-1].Reserved = 4i64;
v28 += 4;
--v29;
}
while( v29 );
v19 = (EVENT_DESCRIPTOR *)&POP_ETW_EVENT_PERFTRACK_RESUME_FROM_HIBERNATE;
goto LABEL_66;
}
}
}
}Referenced by:
PopIssueActionRequest