EtwpLogMemInfoWsHelper
void __fastcall EtwpLogMemInfoWsHelper(__int64 a1, _DWORD *a2){
int v2;
PEVENT_DATA_DESCRIPTOR UserData;
UINT64 Flag;
EVENT_DATA_DESCRIPTOR EventData;
_DWORD *v6;
int v7;
int v8;
EventData.Reserved = 0;
v8 = 0;
v6 = a2 + 1;
v2 = 68 * *a2;
EventData.Ptr = (unsigned __int64)a2;
EventData.Size = 4;
v7 = v2;
if( a1 )
{
LODWORD(Flag) = 4200452;
LOWORD(UserData) = 637;
EtwpLogKernelEvent(&EventData, *(_QWORD *)(a1 + 1080), *(unsigned int *)a1, 2u, (UINT64)UserData, Flag);
}
else
{
LODWORD(UserData) = 4200452;
EtwTraceKernelEvent(&EventData, 2ui64, 0x20800000ui64, 0x27Du, (UINT64)UserData);
if( EtwpHostSiloState != -4516 && (*(_DWORD *)(EtwpHostSiloState + 4520) & 0x800000) != 0 )
EtwWrite(EtwpMemoryProvRegHandle, (EVENT_DESCRIPTOR *)&KERNEL_MEM_EVENT_MEMINFO_WS, 0i64, 2ui64, &EventData);
}
}Referenced by:
EtwpLogMemInfoWs