EtwpLogMemInfoWs

VOID __stdcall EtwpLogMemInfoWs(UINT64 *LoggerId, UINT64 PagedPoolCommitPageCount){
  __int64 v3; 
  unsigned int v4; 
  unsigned int v5; 
  int v6; 
  VOID **PoolWithTag; 
  VOID **v8; 
  __int64 v9; 
  int *v10; 
  int v11; 
  unsigned __int64 v12; 
  UINT64 v13; 
  _LIST_ENTRY *NextProcess; 
  unsigned int *v15; 
  __int64 v16; 
  int Flink_high; 
  int v18; 
  size_t v19; 
  VOID **v20; 
  unsigned int *v21; 
  unsigned __int64 v22; 
  unsigned __int64 v23; 
  unsigned __int64 v24; 
  int v25; 
  char *v26; 
  UINT64 StoreSizeInBytes; 
  UINT64 DataInStoreInBytes; 
  UINT64 *v29; 
  UINT64 v30; 
  __int64 v31[8]; 
  int v32[4]; 

  v30 = PagedPoolCommitPageCount;
  v29 = LoggerId;
  LODWORD(v3) = 64;
  v32[0] = 81;
  v32[1] = 119;
  v32[2] = 120;
  memset(v31, 0i64, sizeof(v31));
  v4 = 0;
  StoreSizeInBytes = 0i64;
  DataInStoreInBytes = 0i64;
  EtwpLogSessionWorkingSetInfo(LoggerId);
  v5 = 4356;
  v6 = -1;
  PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x1104ui64, 1953985605i64);
  v8 = PoolWithTag;
  if( !PoolWithTag )
    return;
  v9 = (__int64)PoolWithTag + 4;
  *(_DWORD *)PoolWithTag = 0;
  v26 = (char *)PoolWithTag + 4356;
  v10 = v32;
  do
  {
    v25 = *v10;
    ZwQuerySystemInformation();
    if( v11 )
      goto LABEL_31;
    *(_DWORD *)v9 = v6;
    v12 = (unsigned __int64)v31[0] >> 12;
    *(_QWORD *)(v9 + 4) = (unsigned __int64)v31[0] >> 12;
    *(_QWORD *)(v9 + 28) = v12;
    *(_QWORD *)(v9 + 12) = v12;
    *(_QWORD *)(v9 + 60) = 0i64;
    *(_QWORD *)(v9 + 20) = v12;
    *(_QWORD *)(v9 + 44) = 0i64;
    *(_QWORD *)(v9 + 36) = 0i64;
    *(_QWORD *)(v9 + 52) = 0i64;
    if( v25 == 119 )
    {
      v13 = v30;
      if( v30 > v12 )
      {
        *(_QWORD *)(v9 + 12) = v30;
        *(_QWORD *)(v9 + 20) = v13;
      }
    }
    ++*(_DWORD *)v8;
    v9 += 68i64;
    --v6;
    ++v4;
    ++v10;
  }
  while( v4 < 3 );
  NextProcess = *(_LIST_ENTRY **)&PsIdleProcess;
  v15 = (unsigned int *)v29;
  if( !*(_QWORD *)&PsIdleProcess )
  {
LABEL_30:
    EtwpLogMemInfoWsHelper(v15, v8);
    goto LABEL_31;
  }
  v16 = (__int64)v26;
  while( 1 )
  {
    Flink_high = HIDWORD(NextProcess[70].Flink);
    if( (Flink_high & 0x4000000) != 0
      && ((Flink_high & 4) == 0
       || !HIDWORD(NextProcess->Flink)
       || LODWORD(NextProcess[95].Flink)
       || NextProcess[3].Flink != &NextProcess[3]) )
    {
      break;
    }
LABEL_27:
    if( NextProcess == *(_LIST_ENTRY **)&PsIdleProcess )
      NextProcess = 0i64;
    NextProcess = PsGetNextProcess((_EPROCESS *)NextProcess);
    if( !NextProcess )
      goto LABEL_30;
  }
  if( v9 != v16 )
  {
LABEL_20:
    *(_DWORD *)v9 = NextProcess[68].Flink;
    *(_QWORD *)(v9 + 4) = NextProcess[111].Blink;
    *(_QWORD *)(v9 + 28) = NextProcess[112].Flink;
    *(_QWORD *)(v9 + 12) = NextProcess[100].Blink;
    *(_QWORD *)(v9 + 60) = NextProcess[146].Blink;
    *(_QWORD *)(v9 + 20) = (unsigned __int64)NextProcess[73].Blink >> 12;
    v22 = *(_QWORD *)(v9 + 12);
    if( v22 >= *(_QWORD *)(v9 + 20) )
      v22 = *(_QWORD *)(v9 + 20);
    v23 = *(_QWORD *)(v9 + 4);
    *(_QWORD *)(v9 + 12) = v22;
    v24 = *(_QWORD *)(v9 + 28);
    if( v24 >= v23 )
      v24 = v23;
    *(_QWORD *)(v9 + 36) = 0i64;
    *(_QWORD *)(v9 + 44) = 0i64;
    *(_QWORD *)(v9 + 28) = v24;
    *(_QWORD *)(v9 + 52) = NextProcess[116].Blink;
    if( SmProcessQueryStoreStats(NextProcess, &StoreSizeInBytes, &DataInStoreInBytes) >= 0 )
    {
      *(_QWORD *)(v9 + 36) = StoreSizeInBytes >> 12;
      *(_QWORD *)(v9 + 44) = DataInStoreInBytes >> 12;
    }
    v9 += 68i64;
    ++*(_DWORD *)v8;
    goto LABEL_27;
  }
  if( (unsigned int)v3 >= 0x100 )
  {
    EtwpLogMemInfoWsHelper(v15, v8);
    *(_DWORD *)v8 = 0;
    v9 = (__int64)v8 + 4;
    goto LABEL_20;
  }
  v18 = 68 * v3;
  v19 = v5;
  v3 = (unsigned int)(2 * v3);
  v5 += v18;
  v20 = ExAllocatePoolWithTag(0x200ui64, v5, 1953985605i64);
  v21 = (unsigned int *)v20;
  if( v20 )
  {
    memmove(v20, v8, v19);
    ExFreePoolWithTag(v8, 0);
    v8 = (VOID **)v21;
    v9 = (__int64)&v21[17 * *v21 + 1];
    v16 = (__int64)&v21[17 * v3 + 1];
    goto LABEL_20;
  }
  ObfDereferenceObjectWithTag(NextProcess, 0x6E457350ui64);
LABEL_31:
  ExFreePoolWithTag(v8, 0);
}

Referenced by: