PopDiagTraceIrpFinishTelemetry
INT64 __fastcall PopDiagTraceIrpFinishTelemetry(INT64 a1, INT64 a2, INT64 a3, INT64 a4, UINT64 a5){
const WCHAR *v5;
__int64 v6;
int v7;
unsigned __int128 v8;
IRP *v9;
__int64 v10;
__int64 v11;
__int64 v12;
DEVICE_OBJECT *DeviceThatFailedIrp;
UINT64 v14;
NTSTATUS v15;
__int16 *v16;
int v17;
int v18;
int v20;
int v21;
int v22;
int v23;
int v24;
__int64 v25;
__int64 v26;
__int64 v27;
struct _EVENT_DATA_DESCRIPTOR v28;
int *v29;
int v30;
int v31;
__int64 *v32;
int v33;
int v34;
__int64 *v35;
int v36;
int v37;
char v38[16];
int *v39;
int v40;
int v41;
int *v42;
int v43;
int v44;
int *v45;
int v46;
int v47;
int *v48;
int v49;
int v50;
__int64 *v51;
int v52;
int v53;
__int16 DriverName[64];
v5 = &ppszDestEnd;
v6 = *(_QWORD *)(a1 + 72i64 * *(char *)(a1 + 66) + 200);
v7 = *(_DWORD *)(a1 + 48);
*(_QWORD *)&v8 = KiQueryUnbiasedInterruptTime(1u);
v10 = *(_QWORD *)(v6 + 48);
v11 = v8;
if( v10 )
{
if( *(_BYTE *)(v6 + 196) )
{
v8 = (unsigned __int64)(v8 - v10) * (unsigned __int128)0x346DC5D63886594Bui64;
v12 = *((_QWORD *)&v8 + 1) >> 11;
if( (unsigned int)(*((_QWORD *)&v8 + 1) >> 11) >= 0x1388 )
{
if( v7 < 0 && !*(_DWORD *)(v6 + 188) )
{
DeviceThatFailedIrp = IoFindDeviceThatFailedIrp(v9);
v15 = PopDiagGetDriverName(DeviceThatFailedIrp, (PWCHAR)DriverName, v14);
v16 = DriverName;
if( v15 < 0 )
v16 = (__int16 *)&ppszDestEnd;
v5 = (const WCHAR *)v16;
}
*(_QWORD *)&v8 = PopComputeWatchdogTimeout(v6);
if( (unsigned int)dword_140C021E8 > 5 )
{
LOBYTE(v8) = tlgKeywordOn((__int64)&dword_140C021E8, 0x400000000000i64);
if( (_BYTE)v8 )
{
v31 = 0;
v34 = 0;
v37 = 0;
v29 = &v20;
v25 = *(_QWORD *)(v6 + 48);
v32 = &v25;
v20 = v12;
v35 = &v26;
v30 = 4;
v33 = 8;
v26 = v11;
v36 = 8;
tlgCreate1Sz_wchar_t((__int64)v38, v5);
v41 = 0;
v44 = 0;
v47 = 0;
v50 = 0;
v53 = 0;
v39 = &v21;
v22 = *(_DWORD *)(v6 + 188);
v42 = &v22;
v45 = &v23;
v48 = &v24;
v51 = &v27;
v21 = v17;
v40 = 4;
v43 = 4;
v23 = v18;
v46 = 4;
v24 = v7;
v49 = 4;
v27 = 0x1000000i64;
v52 = 8;
LODWORD(v8) = tlgWriteTransfer_EtwWriteTransfer(
(__int64)&dword_140C021E8,
(unsigned __int8 *)byte_140027E11,
0i64,
0i64,
0xBu,
&v28);
}
}
}
}
}
return v8;
}Referenced by:
PopDiagTraceIrpFinish