MmLogSystemShareablePfnInfo

VOID __fastcall MmLogSystemShareablePfnInfo(UINT64 LoggerId, VOID *a2){
  __int64 v3; 
  _QWORD *Pool; 
  unsigned __int64 v5; 
  __int64 v6; 
  _MMSUPPORT_INSTANCE *AnyMultiplexedVm; 
  _MMSUPPORT_INSTANCE *v8; 
  unsigned __int64 v9; 
  unsigned __int64 v10; 
  unsigned __int64 v11; 
  _MI_WORKING_SET_TYPE v12; 
  NTSTATUS WorkingSetInfo; 
  __int64 v14; 
  unsigned int PfnInfo; 
  int v16[4]; 

  PfnInfo = (unsigned int)a2;
  v16[0] = 2;
  v16[1] = 3;
  v3 = 0i64;
  v16[2] = 4;
  Pool = 0i64;
  v5 = 0i64;
  v6 = 0i64;
  AnyMultiplexedVm = MiGetAnyMultiplexedVm(MiWorkingSetTypeSystemCache, a2);
  v8 = AnyMultiplexedVm;
  LODWORD(v9) = MiGetAggregateWorkingSetSize(AnyMultiplexedVm);
  if( v9 <= v10 )
    v11 = 64i64;
  else
    v11 = v9 - v10 + 64;
  do
  {
    if( v16[v3] == 2 )
    {
      v8 = AnyMultiplexedVm;
    }
    else
    {
      if( v16[v3] == 3 )
      {
        v12 = MiWorkingSetTypePagedPool;
      }
      else
      {
        if( v16[v3] != 4 )
          goto LABEL_11;
        v12 = MiWorkingSetTypeSystemViews;
      }
      v8 = MiGetAnyMultiplexedVm(v12, (VOID *)(unsigned int)(v16[v3] - 3));
    }
LABEL_11:
    if( v5 >= v11 )
    {
      memset(Pool, 0i64, v6);
    }
    else
    {
      if( Pool )
        ExFreePoolWithTag(Pool, 0);
      v6 = 32 * v11 + 16;
      Pool = MiAllocatePool(64i64, v6, 0x4D777445ui64);
      if( !Pool )
        return;
      v5 = v11;
    }
    WorkingSetInfo = MiGetWorkingSetInfoEx(v8, 0i64, (UINT64)Pool, v6);
    v14 = Pool[1];
    if( WorkingSetInfo >= 0 )
    {
      if( v14 )
        EtwLogPfnInfoRundown(0i64, LoggerId, (_MM_ETW_WORKING_SET_PFN_RUNDOWN *)PfnInfo);
      v3 = (unsigned int)(v3 + 1);
    }
    else
    {
      v11 = v14 + 64;
    }
  }
  while( (unsigned int)v3 < 3 );
  if( Pool )
    ExFreePoolWithTag(Pool, 0);
}

Referenced by:

EtwpKernelTraceRundown