MmLogSystemShareablePfnInfo
VOID __fastcall MmLogSystemShareablePfnInfo(UINT64 LoggerId, VOID *a2){
__int64 v3;
_QWORD *Pool;
unsigned __int64 v5;
__int64 v6;
_MMSUPPORT_INSTANCE *AnyMultiplexedVm;
_MMSUPPORT_INSTANCE *v8;
unsigned __int64 v9;
unsigned __int64 v10;
unsigned __int64 v11;
_MI_WORKING_SET_TYPE v12;
NTSTATUS WorkingSetInfo;
__int64 v14;
unsigned int PfnInfo;
int v16[4];
PfnInfo = (unsigned int)a2;
v16[0] = 2;
v16[1] = 3;
v3 = 0i64;
v16[2] = 4;
Pool = 0i64;
v5 = 0i64;
v6 = 0i64;
AnyMultiplexedVm = MiGetAnyMultiplexedVm(MiWorkingSetTypeSystemCache, a2);
v8 = AnyMultiplexedVm;
LODWORD(v9) = MiGetAggregateWorkingSetSize(AnyMultiplexedVm);
if( v9 <= v10 )
v11 = 64i64;
else
v11 = v9 - v10 + 64;
do
{
if( v16[v3] == 2 )
{
v8 = AnyMultiplexedVm;
}
else
{
if( v16[v3] == 3 )
{
v12 = MiWorkingSetTypePagedPool;
}
else
{
if( v16[v3] != 4 )
goto LABEL_11;
v12 = MiWorkingSetTypeSystemViews;
}
v8 = MiGetAnyMultiplexedVm(v12, (VOID *)(unsigned int)(v16[v3] - 3));
}
LABEL_11:
if( v5 >= v11 )
{
memset(Pool, 0i64, v6);
}
else
{
if( Pool )
ExFreePoolWithTag(Pool, 0);
v6 = 32 * v11 + 16;
Pool = MiAllocatePool(64i64, v6, 0x4D777445ui64);
if( !Pool )
return;
v5 = v11;
}
WorkingSetInfo = MiGetWorkingSetInfoEx(v8, 0i64, (UINT64)Pool, v6);
v14 = Pool[1];
if( WorkingSetInfo >= 0 )
{
if( v14 )
EtwLogPfnInfoRundown(0i64, LoggerId, (_MM_ETW_WORKING_SET_PFN_RUNDOWN *)PfnInfo);
v3 = (unsigned int)(v3 + 1);
}
else
{
v11 = v14 + 64;
}
}
while( (unsigned int)v3 < 3 );
if( Pool )
ExFreePoolWithTag(Pool, 0);
}Referenced by:
EtwpKernelTraceRundown