WheapLogInitEvent
VOID __stdcall WheapLogInitEvent(){
UINT8 *PoolWithTag;
INT64 *v1;
EVENT_DESCRIPTOR *i;
INT64 *v3;
__int64 v4;
UINT8 *v5;
__int128 v6;
UINT64 v7;
unsigned int v8;
UINT8 *v9;
UINT8 *v10;
unsigned int v11;
unsigned int Size;
int Size_4;
EVENT_DATA_DESCRIPTOR UserData;
int *p_Size_4;
int v16;
int v17;
unsigned int *p_Size;
int v19;
int v20;
UINT8 *v21;
unsigned int v22;
int v23;
Size = 1072 * dword_140CDAE5C;
PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(NonPagedPoolNx, (unsigned int)(1072 * dword_140CDAE5C), 0x61656857ui64);
if( PoolWithTag )
{
v1 = (INT64 *)qword_140CDAE68;
for( i = 0i64; v1 != &qword_140CDAE68; v1 = (INT64 *)*v1 )
{
v3 = v1;
v4 = 8i64;
v5 = &PoolWithTag[1072 * (unsigned int)i];
do
{
*(_OWORD *)v5 = *(_OWORD *)v3;
*((_OWORD *)v5 + 1) = *((_OWORD *)v3 + 1);
*((_OWORD *)v5 + 2) = *((_OWORD *)v3 + 2);
*((_OWORD *)v5 + 3) = *((_OWORD *)v3 + 3);
*((_OWORD *)v5 + 4) = *((_OWORD *)v3 + 4);
*((_OWORD *)v5 + 5) = *((_OWORD *)v3 + 5);
*((_OWORD *)v5 + 6) = *((_OWORD *)v3 + 6);
v5 += 128;
v6 = *((_OWORD *)v3 + 7);
v3 += 16;
*((_OWORD *)v5 - 1) = v6;
--v4;
}
while( v4 );
i = (EVENT_DESCRIPTOR *)(unsigned int)((_DWORD)i + 1);
*(_OWORD *)v5 = *(_OWORD *)v3;
*((_OWORD *)v5 + 1) = *((_OWORD *)v3 + 1);
*((_OWORD *)v5 + 2) = *((_OWORD *)v3 + 2);
}
v7 = WheapEtwHandle;
v8 = Size;
UserData.Reserved = 0;
v17 = 0;
v20 = 0;
v23 = 0;
UserData.Ptr = (unsigned __int64)&dword_140CDAE5C;
p_Size_4 = &Size_4;
p_Size = &Size;
UserData.Size = 4;
Size_4 = 10;
v16 = 4;
v19 = 4;
v21 = PoolWithTag;
v22 = Size;
if( EtwEventEnabled(WheapEtwHandle, (EVENT_DESCRIPTOR *)&EVENT_WHEA_INIT_OP, i) == 1 )
{
EtwWrite(v7, (EVENT_DESCRIPTOR *)&EVENT_WHEA_INIT_OP, 0i64, 4ui64, &UserData);
v8 = Size;
}
v9 = (UINT8 *)ExAllocatePoolWithTag(NonPagedPoolNx, v8 + 32i64, 0x61656857ui64);
v10 = v9;
if( v9 )
{
v11 = Size;
*((_DWORD *)v9 + 3) = 0;
*(_DWORD *)v9 = 1733060695;
*((_DWORD *)v9 + 1) = 1;
*((_DWORD *)v9 + 5) = -2147483646;
*((_DWORD *)v9 + 2) = v11 + 32;
*((_DWORD *)v9 + 4) = 1280201291;
*((_DWORD *)v9 + 6) = 2;
*((_DWORD *)v9 + 7) = v11;
memmove(v9 + 32, PoolWithTag, Size);
WheaLogInternalEvent(v10);
ExFreePoolWithTag(v10, 0x61656857u);
}
ExFreePoolWithTag(PoolWithTag, 0x61656857u);
}
}Referenced by:
WheaInitialize