EtwpProcessPerfCtrsRundown

VOID __stdcall EtwpProcessPerfCtrsRundown(_EPROCESS *Process, UINT64 LoggerId){
  volatile unsigned __int64 CommitChargePeak; 
  unsigned int v5; 
  _ETW_SILODRIVERSTATE *v6; 
  int v7[4]; 
  unsigned __int64 PeakVirtualSize; 
  unsigned __int64 v9; 
  volatile unsigned __int64 v10; 
  unsigned __int64 v11; 
  unsigned __int64 v12; 
  unsigned __int64 VirtualSize; 
  unsigned __int64 v14; 
  volatile unsigned __int64 v15; 
  unsigned __int64 v16; 
  unsigned __int64 v17; 
  volatile unsigned __int64 v18; 
  int *v19; 
  int v20; 
  int v21; 

  v7[3] = 0;
  v7[0] = (int)Process->UniqueProcessId;
  v7[2] = ObGetProcessHandleCount((_EX_RUNDOWN_REF *)Process, 0i64);
  v7[1] = Process->Vm.Instance.PageFaultCount;
  VirtualSize = Process->VirtualSize;
  PeakVirtualSize = Process->PeakVirtualSize;
  v14 = Process->Vm.Instance.WorkingSetLeafSize << 12;
  v9 = Process->Vm.Instance.PeakWorkingSetSize << 12;
  v16 = Process->ProcessQuotaUsage[1];
  v11 = Process->ProcessQuotaPeak[1];
  v17 = Process->ProcessQuotaUsage[0];
  v12 = Process->ProcessQuotaPeak[0];
  v15 = Process->CommitCharge << 12;
  CommitChargePeak = Process->CommitChargePeak;
  v21 = 0;
  v5 = *(_DWORD *)LoggerId;
  v6 = *(_ETW_SILODRIVERSTATE **)(LoggerId + 1080);
  v10 = CommitChargePeak << 12;
  v18 = v15;
  v19 = v7;
  v20 = 104;
  EtwpLogKernelEvent((__int64)&v19, v6, v5, 1u, 0x321u, 0x401802u);
}

Referenced by: