EtwpEnumerateAddressSpace
VOID __stdcall EtwpEnumerateAddressSpace(
_EPROCESS *Process,
_ETW_RUNDOWN_CONTEXT *RundownContext,
PERFINFO_GROUPMASK *GroupMasks){
PERFINFO_GROUPMASK v3;
int v4;
_EPROCESS *v6;
int v7;
int v8;
int v9;
VOID **PoolWithTag;
UINT16 v11;
__m128i *v12;
__m128i *i;
__int64 v14;
int v15;
unsigned __int64 v16;
__int64 v17;
__int64 v18;
int v19;
int v20;
INT64 a9;
_ADAPTER_OBJECT *v22;
unsigned int v23;
int v24;
unsigned int v25;
char v26;
unsigned __int64 v27;
__m128i v28;
__m128i v29;
int v30;
int v31;
INT64 a5;
INT64 a6;
UINT64 a7;
INT64 LocksHeld;
UINT64 ReturnLength;
__int16 v37;
__int16 v38;
int v39;
int v40;
int v41;
unsigned int v42;
int v43;
int v44;
int v45;
PERFINFO_GROUPMASK v46;
int v47;
int v48;
int v49;
NTSTATUS v50;
_EPROCESS *Processa;
UINT64 LoggerId;
int v53;
int v54;
int v55;
int v56;
__int64 v57;
__int64 v58;
unsigned __int64 v59;
VOID **v60;
UINT64 v61;
INT64 v62;
__int64 v63;
__m128i *v64;
INT64 v65;
INT8 a8[8];
_EPROCESS *v67;
_ETW_RUNDOWN_CONTEXT *v68;
PVOID P;
__int128 v70;
__m128i *v71;
unsigned int v72;
int v73;
v6 = Process;
Processa = Process;
v67 = Process;
v68 = RundownContext;
LODWORD(ReturnLength) = 0;
v70 = 0i64;
v57 = 0i64;
if( !GroupMasks || (v3 = *GroupMasks, v7 = 1, (*GroupMasks & 4) == 0) )
v7 = 0;
if( !GroupMasks || (v3 = GroupMasks[1], LOBYTE(v3) = 1, (GroupMasks[1] & 0x8000) == 0) )
LOBYTE(v3) = 0;
v8 = v7 | 4;
if( !(_BYTE)v3 )
v8 = v7;
v9 = v8;
v39 = v8;
if( RundownContext )
{
if( !GroupMasks || (v3 = *GroupMasks, LOBYTE(v3) = 1, (*GroupMasks & 0x8000) == 0) )
LOBYTE(v3) = 0;
v39 = v8;
if( (_BYTE)v3 )
{
v9 = v8 | 2;
v39 = v8 | 2;
}
}
if( !v9 )
{
PoolWithTag = 0i64;
goto LABEL_38;
}
if( RundownContext )
{
LoggerId = *((_QWORD *)RundownContext + 4);
v61 = LoggerId;
v26 = *((_BYTE *)RundownContext + 64);
PoolWithTag = (VOID **)*((_QWORD *)RundownContext + 2);
LOWORD(v7) = 5124 - (v26 != 0);
v43 = v7;
WORD2(ReturnLength) = v7;
LOWORD(v4) = 1064 - (v26 != 0);
LOWORD(v3) = 641 - (v26 != 0);
}
else
{
PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x2000ui64, 1718773072i64);
v4 = 1062;
v3 = 611;
LoggerId = 0i64;
v61 = 0i64;
v43 = 0;
WORD2(ReturnLength) = 0;
v6 = Processa;
}
v38 = v3;
v46 = v3;
v37 = v4;
v40 = v4;
v60 = PoolWithTag;
if( PoolWithTag || (v9 &= ~1u, (v39 = v9) != 0) )
{
v59 = 0i64;
v47 = 0;
v58 = 0i64;
v48 = 0;
v63 = 0i64;
v11 = 0;
v42 = 0;
v12 = (__m128i *)MmEnumerateAddressSpaceAndReferenceImages(v6, v9);
P = v12;
if( v12 )
{
for( i = v12; ; i += 3 )
{
v64 = i;
if( !i->m128i_i64[0] )
{
ExFreePoolWithTag(P, 0);
goto LABEL_38;
}
v14 = i->m128i_i64[0] & 3;
i->m128i_i64[0] &= 0xFFFFFFFFFFFFFFFCui64;
v15 = 0;
v45 = 0;
v54 = 0;
if( !v14 )
break;
if( v14 != 2 )
{
v11 = v4;
v25 = 0x8000;
v42 = 0x8000;
v15 = 3;
v23 = 44;
LODWORD(ReturnLength) = 44;
v24 = 1;
goto LABEL_34;
}
v11 = v46;
v25 = 536903680;
v42 = 536903680;
if( RundownContext )
{
v23 = 32;
LODWORD(ReturnLength) = 32;
}
else
{
LODWORD(ReturnLength) = 24;
i[1].m128i_i32[1] = 0x8000;
v23 = ReturnLength;
}
LABEL_58:
if( RundownContext )
{
v30 = 5249026;
if( v15 )
v30 = v15 | 0x501800;
*(_QWORD *)&v70 = i;
*((_QWORD *)&v70 + 1) = v23;
EtwpLogKernelEvent(
(__int64)&v70,
*(_ETW_SILODRIVERSTATE **)(LoggerId + 1080),
*(_DWORD *)LoggerId,
1u,
v11,
v30);
}
else
{
v31 = 5249282;
if( v15 )
v31 = v15 | 0x501900;
v71 = i;
v72 = v23;
v73 = 0;
EtwTraceKernelEvent((__int64)&v71, 1u, v25, v11, v31);
}
LABEL_35:
;
}
if( (v9 & 2) != 0 )
{
v41 = 1;
v27 = i->m128i_u64[1];
v59 = (v27 >> 1) & 0x1F;
v47 = (v27 >> 1) & 0x1F;
v63 = i[2].m128i_i64[0];
v16 = v27 & 0xFFFFFFFFFFFFFFC0ui64;
i->m128i_i64[1] = v27 & 0xFFFFFFFFFFFFFFC0ui64;
LODWORD(v27) = v27 & 1;
v58 = (unsigned int)v27;
v48 = v27;
}
else
{
v41 = 0;
v16 = i->m128i_u64[1];
}
v17 = (v16 >> 6) & 0xF;
v56 = (v16 >> 6) & 0xF;
*(_QWORD *)a8 = (v16 >> 10) & 7;
v53 = (v16 >> 10) & 7;
i->m128i_i64[1] = v16 & 0xFFFFFFFFFFFFE03Fui64;
v57 = 0i64;
if( KeAreAllApcsDisabled() )
__int2c();
if( !*(&stru_140CF2E80 + 599)
|| (v50 = (*(__int64(__fastcall **)(__int64, __int64, VOID **, __int64 *))(*(&stru_140CF2E80 + 599) + 24i64))(
i->m128i_i64[0],
1024i64,
PoolWithTag,
&v57),
v50 < 0) )
{
v50 = ObQueryNameStringMode(
(VOID *)i->m128i_i64[0],
(_OBJECT_NAME_INFORMATION *)PoolWithTag,
0x2000ui64,
&ReturnLength,
0);
}
v44 = 0;
v55 = i[2].m128i_i32[2];
v49 = v55;
v65 = i[1].m128i_i64[0];
v62 = v65;
LODWORD(v18) = RtlImageNtHeader(i->m128i_u64[1]);
if( v18 )
{
v19 = *(_DWORD *)(v18 + 88);
v49 = v19;
v20 = *(_DWORD *)(v18 + 8);
v44 = v20;
a9 = *(_QWORD *)(v18 + 48);
v62 = a9;
}
else
{
v20 = v44;
v19 = v55;
a9 = v65;
}
if( v50 >= 0 )
{
if( RundownContext )
{
LODWORD(a7) = *(_DWORD *)a8;
LODWORD(a6) = v17;
EtwpTraceImageRundown(
LoggerId,
v43,
(_UNICODE_STRING *)PoolWithTag,
Processa->UniqueProcessId,
i->m128i_i32,
a6,
a7);
}
else
{
LODWORD(LocksHeld) = 0;
LODWORD(a6) = v20;
LODWORD(a5) = v19;
EtwpTraceImageUnload(
(_UNICODE_STRING *)PoolWithTag,
(INT64)Processa,
i->m128i_i64[1],
i[1].m128i_i64[1],
a5,
a6,
v17,
a8[0],
a9,
LocksHeld);
}
}
if( v57 )
(*(void(**)(void))(*(&stru_140CF2E80 + 599) + 32i64))();
v22 = (_ADAPTER_OBJECT *)i->m128i_i64[0];
if( v41 )
{
v28 = *i;
v29 = i[1];
*i = 0i64;
i[1] = 0i64;
i[2] = 0i64;
i[2].m128i_i32[2] = (int)Processa->UniqueProcessId;
i->m128i_i64[1] = *(_QWORD *)(v28.m128i_i64[0] + 24);
i->m128i_i64[0] = _mm_srli_si128(v28, 8).m128i_u64[0];
i[1].m128i_i64[1] = _mm_srli_si128(v29, 8).m128i_u64[0];
i[2].m128i_i64[0] = v63;
i[1].m128i_i64[0] = i[1].m128i_i64[0] & 0xFF40FFFFFFFFFFFFui64 | ((v59 & 0x1F | (32 * (v58 & 1))) << 48) | 0x40000000000000i64;
LOWORD(v4) = v40;
v11 = v40;
v42 = 0x8000;
v45 = 3;
LODWORD(ReturnLength) = 44;
}
else
{
LOWORD(v4) = v40;
}
HalPutDmaAdapter(v22);
v23 = ReturnLength;
v24 = v41;
v15 = v45;
v25 = v42;
LABEL_34:
if( !v24 )
goto LABEL_35;
goto LABEL_58;
}
}
LABEL_38:
if( !RundownContext && PoolWithTag )
ExFreePoolWithTag(PoolWithTag, 0);
}Referenced by:
EtwpProcessEnumCallback