EtwpEnumerateAddressSpace
VOID __fastcall EtwpEnumerateAddressSpace(INT64 a1, INT64 a2, INT64 *a3){
int v3;
int v4;
ULONG_PTR v6;
int v7;
int v8;
int v9;
OBJECT_NAME_INFORMATION *PoolWithTag;
UINT16 v11;
__m128i *v12;
__m128i *i;
__int64 v14;
int v15;
unsigned __int64 v16;
__int64 v17;
IMAGE_NT_HEADERS *v18;
int CheckSum;
int TimeDateStamp;
INT64 ImageBase;
struct _DMA_ADAPTER *v22;
unsigned int v23;
int v24;
UINT64 v25;
char v26;
unsigned __int64 v27;
__m128i v28;
__m128i v29;
int v30;
int v31;
INT64 v32;
UINT64 v33;
INT64 v34;
UINT64 ReturnLength;
__int16 v36;
__int16 v37;
int v38;
int v39;
int v40;
unsigned int v41;
int v42;
int v43;
int v44;
int v45;
int v46;
int v47;
int v48;
int v49;
ULONG_PTR BugCheckParameter1;
INT64 *v51;
int v52;
int v53;
int v54;
int v55;
__int64 v56;
__int64 v57;
unsigned __int64 v58;
OBJECT_NAME_INFORMATION *v59;
INT64 *v60;
INT64 v61;
__int64 v62;
__m128i *v63;
INT64 v64;
CHAR v65[8];
INT64 v66;
INT64 v67;
PVOID P;
EVENT_DATA_DESCRIPTOR EventData;
EVENT_DATA_DESCRIPTOR v70;
v6 = a1;
BugCheckParameter1 = a1;
v66 = a1;
v67 = a2;
LODWORD(ReturnLength) = 0;
EventData = 0i64;
v56 = 0i64;
if( !a3 || (v3 = *(_DWORD *)a3, v7 = 1, (*(_DWORD *)a3 & 4) == 0) )
v7 = 0;
if( !a3 || (v3 = *((_DWORD *)a3 + 1), LOBYTE(v3) = 1, (*((_DWORD *)a3 + 1) & 0x8000) == 0) )
LOBYTE(v3) = 0;
v8 = v7 | 4;
if( !(_BYTE)v3 )
v8 = v7;
v9 = v8;
v38 = v8;
if( a2 )
{
if( !a3 || (v3 = *(_DWORD *)a3, LOBYTE(v3) = 1, (*(_DWORD *)a3 & 0x8000) == 0) )
LOBYTE(v3) = 0;
v38 = v8;
if( (_BYTE)v3 )
{
v9 = v8 | 2;
v38 = v8 | 2;
}
}
if( !v9 )
{
PoolWithTag = 0i64;
goto LABEL_38;
}
if( a2 )
{
v51 = *(INT64 **)(a2 + 32);
v60 = v51;
v26 = *(_BYTE *)(a2 + 64);
PoolWithTag = *(OBJECT_NAME_INFORMATION **)(a2 + 16);
LOWORD(v7) = 5124 - (v26 != 0);
v42 = v7;
WORD2(ReturnLength) = v7;
LOWORD(v4) = 1064 - (v26 != 0);
LOWORD(v3) = 641 - (v26 != 0);
}
else
{
PoolWithTag = (OBJECT_NAME_INFORMATION *)ExAllocatePoolWithTag(NonPagedPoolNx, 0x2000ui64, 0x66726550ui64);
v4 = 1062;
v3 = 611;
v51 = 0i64;
v60 = 0i64;
v42 = 0;
WORD2(ReturnLength) = 0;
v6 = BugCheckParameter1;
}
v37 = v3;
v45 = v3;
v36 = v4;
v39 = v4;
v59 = PoolWithTag;
if( PoolWithTag || (v9 &= ~1u, (v38 = v9) != 0) )
{
v58 = 0i64;
v46 = 0;
v57 = 0i64;
v47 = 0;
v62 = 0i64;
v11 = 0;
v41 = 0;
v12 = (__m128i *)MmEnumerateAddressSpaceAndReferenceImages(v6, v9);
P = v12;
if( v12 )
{
for( i = v12; ; i += 3 )
{
v63 = i;
if( !i->m128i_i64[0] )
{
ExFreePoolWithTag(P, 0);
goto LABEL_38;
}
v14 = i->m128i_i64[0] & 3;
i->m128i_i64[0] &= 0xFFFFFFFFFFFFFFFCui64;
v15 = 0;
v44 = 0;
v53 = 0;
if( !v14 )
break;
if( v14 != 2 )
{
v11 = v4;
v25 = 0x8000i64;
v41 = 0x8000;
v15 = 3;
v23 = 44;
LODWORD(ReturnLength) = 44;
v24 = 1;
goto LABEL_34;
}
v11 = v45;
v25 = 536903680i64;
v41 = 536903680;
if( a2 )
{
v23 = 32;
LODWORD(ReturnLength) = 32;
}
else
{
LODWORD(ReturnLength) = 24;
i[1].m128i_i32[1] = 0x8000;
v23 = ReturnLength;
}
LABEL_58:
if( a2 )
{
v30 = 5249026;
if( v15 )
v30 = v15 | 0x501800;
EventData.Ptr = (unsigned __int64)i;
EventData.Size = v23;
EventData.Reserved = 0;
LODWORD(v33) = v30;
LOWORD(v32) = v11;
EtwpLogKernelEvent(&EventData, v51[135], *(unsigned int *)v51, 1u, v32, v33);
}
else
{
v31 = 5249282;
if( v15 )
v31 = v15 | 0x501900;
v70.Ptr = (unsigned __int64)i;
v70.Size = v23;
v70.Reserved = 0;
LODWORD(v32) = v31;
EtwTraceKernelEvent(&v70, 1ui64, v25, v11, v32);
}
LABEL_35:
;
}
if( (v9 & 2) != 0 )
{
v40 = 1;
v27 = i->m128i_u64[1];
v58 = (v27 >> 1) & 0x1F;
v46 = (v27 >> 1) & 0x1F;
v62 = i[2].m128i_i64[0];
v16 = v27 & 0xFFFFFFFFFFFFFFC0ui64;
i->m128i_i64[1] = v27 & 0xFFFFFFFFFFFFFFC0ui64;
LODWORD(v27) = v27 & 1;
v57 = (unsigned int)v27;
v47 = v27;
}
else
{
v40 = 0;
v16 = i->m128i_u64[1];
}
v17 = (v16 >> 6) & 0xF;
v55 = (v16 >> 6) & 0xF;
*(_QWORD *)v65 = (v16 >> 10) & 7;
v52 = (v16 >> 10) & 7;
i->m128i_i64[1] = v16 & 0xFFFFFFFFFFFFE03Fui64;
v56 = 0i64;
if( KeAreAllApcsDisabled() )
__int2c();
if( !FltMgrCallbacks
|| (v49 = (*(__int64(__fastcall **)(__int64, __int64, OBJECT_NAME_INFORMATION *, __int64 *))(FltMgrCallbacks + 24))(
i->m128i_i64[0],
1024i64,
PoolWithTag,
&v56),
v49 < 0) )
{
v49 = ObQueryNameStringMode((VOID *)i->m128i_i64[0], PoolWithTag, 0x2000ui64, &ReturnLength, 0);
}
v43 = 0;
v54 = i[2].m128i_i32[2];
v48 = v54;
v64 = i[1].m128i_i64[0];
v61 = v64;
v18 = RtlImageNtHeader((PVOID)i->m128i_i64[1]);
if( v18 )
{
CheckSum = v18->OptionalHeader.CheckSum;
v48 = CheckSum;
TimeDateStamp = v18->FileHeader.TimeDateStamp;
v43 = TimeDateStamp;
ImageBase = v18->OptionalHeader.ImageBase;
v61 = ImageBase;
}
else
{
TimeDateStamp = v43;
CheckSum = v54;
ImageBase = v64;
}
if( v49 >= 0 )
{
if( a2 )
{
EtwpTraceImageRundown(
v51,
v42,
&PoolWithTag->Name.Length,
*(_QWORD *)(BugCheckParameter1 + 1088),
(INT64)i,
v17,
v65[0]);
}
else
{
LODWORD(v34) = 0;
LODWORD(v33) = TimeDateStamp;
LODWORD(v32) = CheckSum;
EtwpTraceImageUnload(
(INT64)PoolWithTag,
BugCheckParameter1,
i->m128i_i64[1],
i[1].m128i_i64[1],
v32,
v33,
v17,
v65[0],
ImageBase,
v34);
}
}
if( v56 )
(*(void(**)(void))(FltMgrCallbacks + 32))();
v22 = (struct _DMA_ADAPTER *)i->m128i_i64[0];
if( v40 )
{
v28 = *i;
v29 = i[1];
*i = 0i64;
i[1] = 0i64;
i[2] = 0i64;
i[2].m128i_i32[2] = *(_DWORD *)(BugCheckParameter1 + 1088);
i->m128i_i64[1] = *(_QWORD *)(v28.m128i_i64[0] + 24);
i->m128i_i64[0] = _mm_srli_si128(v28, 8).m128i_u64[0];
i[1].m128i_i64[1] = _mm_srli_si128(v29, 8).m128i_u64[0];
i[2].m128i_i64[0] = v62;
i[1].m128i_i64[0] = i[1].m128i_i64[0] & 0xFF40FFFFFFFFFFFFui64 | ((v58 & 0x1F | (32 * (v57 & 1))) << 48) | 0x40000000000000i64;
LOWORD(v4) = v39;
v11 = v39;
v41 = 0x8000;
v44 = 3;
LODWORD(ReturnLength) = 44;
}
else
{
LOWORD(v4) = v39;
}
HalPutDmaAdapter(v22);
v23 = ReturnLength;
v24 = v40;
v15 = v44;
v25 = v41;
LABEL_34:
if( !v24 )
goto LABEL_35;
goto LABEL_58;
}
}
LABEL_38:
if( !a2 && PoolWithTag )
ExFreePoolWithTag(PoolWithTag, 0);
}Referenced by:
EtwpProcessEnumCallback