EtwTraceWakeCounter
VOID __fastcall EtwTraceWakeCounter(
VOID *Object,
_PS_WAKE_REASON WakeReason,
INT64 Count,
_EPROCESS *Process,
UINT64 Tag){
int v5;
__int16 v6;
UINT64 v7;
UINT16 v8;
UINT64 Flag;
__int64 v10[2];
int v11;
int v12;
EVENT_DATA_DESCRIPTOR EventData;
v5 = Count;
if( Count <= 0 )
{
if( !Count )
{
v6 = 848;
v7 = 2147484160i64;
goto LABEL_7;
}
v6 = 832;
}
else
{
v6 = 816;
}
v7 = 2147491840i64;
LABEL_7:
v8 = v6 + WakeReason;
v10[0] = (__int64)Object;
v10[1] = Tag;
v12 = v5;
if( Process )
v11 = *((_DWORD *)Process + 272);
else
v11 = -1;
EventData.Reserved = 0;
EventData.Ptr = (unsigned __int64)v10;
EventData.Size = 24;
LODWORD(Flag) = 5249282;
EtwTraceKernelEvent(&EventData, 1ui64, v7, v8, Flag);
}Referenced by:
PspChargeJobWakeCounter
PspChargeProcessWakeCounter