EtwpLogMemInfoWsHelper
void __fastcall EtwpLogMemInfoWsHelper(unsigned int *a1, _DWORD *a2){
int v2;
_EVENT_DATA_DESCRIPTOR UserData;
_DWORD *v4;
int v5;
int v6;
UserData.Reserved = 0;
v6 = 0;
v4 = a2 + 1;
v2 = 68 * *a2;
UserData.Ptr = (unsigned __int64)a2;
UserData.Size = 4;
v5 = v2;
if( a1 )
{
EtwpLogKernelEvent((__int64)&UserData, *((_ETW_SILODRIVERSTATE **)a1 + 135), *a1, 2u, 0x27Du, 0x401804u);
}
else
{
EtwTraceKernelEvent((__int64)&UserData, 2u, 0x20800000u, 0x27Du, 0x401804u);
if( EtwpHostSiloState != -4516 && (*(_DWORD *)(EtwpHostSiloState + 4520) & 0x800000) != 0 )
EtwWrite(*(&ExBootDevicesRemovedEvent + 251), &KERNEL_MEM_EVENT_MEMINFO_WS, 0, 2u, &UserData);
}
}Referenced by:
EtwpLogMemInfoWs