EtwpEnumerateWorkingSet

void *__fastcall EtwpEnumerateWorkingSet(__int64 a1, __int64 a2){
  void *result; 
  __int64 v5; 
  UINT64 v6; 
  __int64 *v7; 
  result = *(void **)(a2 + 48);
  v5 = 4096i64;
  while( 1 )
  {
    if( !result )
    {
      v6 = 32 * v5 + 16;
      *(_QWORD *)(a2 + 56) = v6;
      result = ExAllocatePoolWithTag(NonPagedPoolNx, v6, 0x74777445ui64);
      *(_QWORD *)(a2 + 48) = result;
      if( !result )
        break;
    }
    memset((INT64)result, 0i64);
    result = (void *)MiGetWorkingSetInfoEx(a1 + 1664, 0i64, *(UINT64 **)(a2 + 48), *(_QWORD *)(a2 + 56));
    v7 = *(__int64 **)(a2 + 48);
    if( (_DWORD)result != -1073741820 )
    {
      if( (int)result >= 0 )
      {
        if( v7[1] )
          return(void *)EtwLogPfnInfoRundown(
                           a1,
                           *(_QWORD *)(*(_QWORD *)(a2 + 32) + 1080i64),
                           **(_DWORD **)(a2 + 32),
                           v7);
      }
      return result;
    }
    v5 = v7[1] + 64;
    ExFreePoolWithTag(*(PVOID *)(a2 + 48), 0);
    *(_QWORD *)(a2 + 48) = 0i64;
    result = 0i64;
  }
  return result;
}

Referenced by: