EtwpPoolRunDown
VOID __stdcall EtwpPoolRunDown(UINT64 LoggerId, UINT8 Start){
VOID **v2;
UINT8 v3;
unsigned int v5;
UINT16 v6;
VOID **PoolWithTag;
NTSTATUS PoolTagInfo;
unsigned int v9;
__int64 v10;
unsigned int v11;
_ETW_SILODRIVERSTATE *v12;
int v13;
unsigned int v14;
VOID **v15;
NTSTATUS BigPoolInfo;
unsigned int v17;
__int64 v18;
unsigned int v19;
_ETW_SILODRIVERSTATE *v20;
int v21;
_EPROCESS *i;
unsigned int v23;
unsigned int v24;
VOID **v25;
NTSTATUS SessionPoolTagInfo;
unsigned int v27;
__int64 v28;
unsigned int v29;
_ETW_SILODRIVERSTATE *v30;
int v31;
unsigned int v32;
VOID **v33;
NTSTATUS v34;
unsigned int v35;
__int64 v36;
unsigned int v37;
_ETW_SILODRIVERSTATE *v38;
int v39;
_EPROCESS *NextSession;
_EPROCESS *v41;
UINT64 ReturnedEntries;
NTSTATUS SessionId;
UINT64 ActualEntries;
_KAPC_STATE ApcState;
UINT64 *p_ReturnedEntries;
int v48;
int v49;
NTSTATUS *p_SessionId;
int v51;
int v52;
__int64 v53;
int v54;
int v55;
LODWORD(ActualEntries) = 0;
ReturnedEntries = 0x3000000000i64;
v2 = 0i64;
SessionId = 0;
v49 = 0;
v3 = Start;
p_ReturnedEntries = &ReturnedEntries;
v48 = 4;
v5 = 48;
v6 = 3625 - (Start != 0);
memset(&ApcState, 0, sizeof(ApcState));
while( 1 )
{
if( v2 )
ExFreePoolWithTag(v2, 0);
PoolWithTag = ExAllocatePoolWithTag(1ui64, v5, 1953985605i64);
v2 = PoolWithTag;
if( !PoolWithTag )
break;
PoolTagInfo = ExGetPoolTagInfo(PoolWithTag, v5, (UINT64 *)((char *)&ReturnedEntries + 4));
if( PoolTagInfo != -1073741820 )
{
if( PoolTagInfo >= 0 )
{
v9 = *(_DWORD *)v2;
v10 = (__int64)(v2 + 1);
if( *(_DWORD *)v2 )
{
do
{
v11 = *(_DWORD *)LoggerId;
v12 = *(_ETW_SILODRIVERSTATE **)(LoggerId + 1080);
v13 = v9;
p_SessionId = (NTSTATUS *)v10;
if( v9 > 0x64 )
v13 = 100;
v52 = 0;
LODWORD(ReturnedEntries) = v13;
v51 = 40 * v13;
EtwpLogKernelEvent((__int64)&p_ReturnedEntries, v12, v11, 2u, v6, 0x401802u);
v10 += 40i64 * (unsigned int)ReturnedEntries;
v9 -= ReturnedEntries;
}
while( v9 );
v3 = Start;
}
}
break;
}
v5 = HIDWORD(ReturnedEntries);
}
v14 = 32;
for( HIDWORD(ReturnedEntries) = 32; ; v14 = HIDWORD(ReturnedEntries) )
{
if( v2 )
ExFreePoolWithTag(v2, 0);
v15 = ExAllocatePoolWithTag(1ui64, v14, 1953985605i64);
v2 = v15;
if( !v15 )
break;
BigPoolInfo = ExGetBigPoolInfo(v15, v14, 1ui64, (UINT64 *)((char *)&ReturnedEntries + 4));
if( BigPoolInfo != -1073741820 )
{
if( BigPoolInfo >= 0 )
{
v17 = *(_DWORD *)v2;
v18 = (__int64)(v2 + 1);
if( *(_DWORD *)v2 )
{
do
{
v19 = *(_DWORD *)LoggerId;
v20 = *(_ETW_SILODRIVERSTATE **)(LoggerId + 1080);
v21 = v17;
p_SessionId = (NTSTATUS *)v18;
if( v17 > 0x64 )
v21 = 100;
v52 = 0;
LODWORD(ReturnedEntries) = v21;
v51 = 24 * v21;
EtwpLogKernelEvent((__int64)&p_ReturnedEntries, v20, v19, 2u, 3627 - (v3 != 0), 0x401802u);
v18 += 24i64 * (unsigned int)ReturnedEntries;
v17 -= ReturnedEntries;
}
while( v17 );
v3 = Start;
}
}
break;
}
}
for( i = 0i64; ; i = v41 )
{
NextSession = (_EPROCESS *)MmGetNextSession(i);
v41 = NextSession;
if( !NextSession )
break;
if( MmAttachSession(NextSession, &ApcState) >= 0 )
{
SessionId = MmGetSessionId(v41);
v23 = 4000;
v24 = 4000;
while( 1 )
{
if( v2 )
ExFreePoolWithTag(v2, 0);
v25 = ExAllocatePoolWithTag(1ui64, v24, 1953985605i64);
v2 = v25;
if( !v25 )
break;
SessionPoolTagInfo = ExGetSessionPoolTagInfo(v25, v23, &ReturnedEntries, &ActualEntries);
v23 = 40 * ActualEntries;
v24 = 40 * ActualEntries;
if( SessionPoolTagInfo != -1073741820 )
{
if( SessionPoolTagInfo >= 0 )
{
v52 = 0;
v27 = ReturnedEntries;
v28 = (__int64)v2;
p_SessionId = &SessionId;
v51 = 4;
if( (_DWORD)ReturnedEntries )
{
do
{
v29 = *(_DWORD *)LoggerId;
v30 = *(_ETW_SILODRIVERSTATE **)(LoggerId + 1080);
v31 = v27;
v53 = v28;
if( v27 > 0x64 )
v31 = 100;
v55 = 0;
LODWORD(ReturnedEntries) = v31;
v54 = 40 * v31;
EtwpLogKernelEvent((__int64)&p_ReturnedEntries, v30, v29, 3u, 3629 - (v3 != 0), 0x401802u);
v28 += 40i64 * (unsigned int)ReturnedEntries;
v27 -= ReturnedEntries;
}
while( v27 );
v3 = Start;
}
}
break;
}
}
v32 = 40;
for( HIDWORD(ReturnedEntries) = 40; ; v32 = HIDWORD(ReturnedEntries) )
{
if( v2 )
ExFreePoolWithTag(v2, 0);
v33 = ExAllocatePoolWithTag(1ui64, v32, 1953985605i64);
v2 = v33;
if( !v33 )
break;
v34 = ExGetBigPoolInfo(v33, v32, 0i64, (UINT64 *)((char *)&ReturnedEntries + 4));
if( v34 != -1073741820 )
{
if( v34 >= 0 )
{
v52 = 0;
v35 = *((_DWORD *)v2 + 3);
v36 = (__int64)(v2 + 2);
p_SessionId = &SessionId;
v51 = 4;
if( v35 )
{
do
{
v37 = *(_DWORD *)LoggerId;
v38 = *(_ETW_SILODRIVERSTATE **)(LoggerId + 1080);
v39 = v35;
v53 = v36;
if( v35 > 0x64 )
v39 = 100;
v55 = 0;
LODWORD(ReturnedEntries) = v39;
v54 = 24 * v39;
EtwpLogKernelEvent((__int64)&p_ReturnedEntries, v38, v37, 3u, 3631 - (v3 != 0), 0x401802u);
v36 += 24i64 * (unsigned int)ReturnedEntries;
v35 -= ReturnedEntries;
}
while( v35 );
v3 = Start;
}
}
break;
}
}
MmDetachSession(v41, &ApcState);
}
}
if( v2 )
ExFreePoolWithTag(v2, 0);
}Referenced by:
EtwpKernelTraceRundown