EtwpLogSessionWorkingSetInfo

VOID __stdcall EtwpLogSessionWorkingSetInfo(UINT64 *LoggerId){
  VOID **v2; 
  VOID **PoolWithTag; 
  int v4; 
  VOID **v5; 
  int v6; 
  __int64 i; 
  __int64 v8; 
  __int64 v9; 
  int v10; 
  __int64 v11; 
  VOID *v12; 
  VOID *v13; 
  UINT64 SessionCount; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  VOID **v16; 
  int v17; 
  int v18; 

  LODWORD(SessionCount) = 10;
  v2 = 0i64;
  while( 1 )
  {
    if( v2 )
      ExFreePoolWithTag(v2, 0);
    PoolWithTag = ExAllocatePoolWithTag(0x200ui64, (unsigned int)(40 * SessionCount), 1953985605i64);
    v2 = PoolWithTag;
    if( !PoolWithTag )
      break;
    MmQuerySessionWorkingSetInformation((_SYSTEM_WORKINGSET_ENTRY *)PoolWithTag, &SessionCount);
    if( v4 != -1073741820 )
    {
      if( (_DWORD)SessionCount )
      {
        v5 = ExAllocatePoolWithTag(0x200ui64, (unsigned int)(68 * SessionCount), 1953985605i64);
        if( v5 )
        {
          v6 = SessionCount;
          for( i = 0i64; (unsigned int)i < (unsigned int)SessionCount; v6 = SessionCount )
          {
            v8 = 5 * i;
            v9 = (unsigned int)i;
            v10 = (int)v2[5 * i];
            i = (unsigned int)(i + 1);
            v11 = 68 * v9;
            *(_DWORD *)((char *)v5 + v11) = v10;
            *(VOID **)((char *)v5 + v11 + 4) = v2[v8 + 1];
            v12 = v2[v8 + 2];
            *(VOID **)((char *)v5 + v11 + 60) = 0i64;
            *(VOID **)((char *)v5 + v11 + 12) = v12;
            *(VOID **)((char *)v5 + v11 + 20) = v2[v8 + 3];
            v13 = v2[v8 + 4];
            *(VOID **)((char *)v5 + v11 + 44) = 0i64;
            *(VOID **)((char *)v5 + v11 + 36) = 0i64;
            *(VOID **)((char *)v5 + v11 + 52) = 0i64;
            *(VOID **)((char *)v5 + v11 + 28) = v13;
          }
          UserData.Reserved = 0;
          v18 = 0;
          UserData.Ptr = (unsigned __int64)&SessionCount;
          UserData.Size = 4;
          v16 = v5;
          v17 = 68 * v6;
          if( LoggerId )
          {
            EtwpLogKernelEvent(
              (__int64)&UserData,
              (_ETW_SILODRIVERSTATE *)LoggerId[135],
              *(_DWORD *)LoggerId,
              2u,
              0x27Eu,
              0x401804u);
          }
          else if( EtwpHostSiloState != -4516 && (*(_DWORD *)(EtwpHostSiloState + 4520) & 0x800000) != 0 )
          {
            EtwWrite(*(&ExBootDevicesRemovedEvent + 251), &KERNEL_MEM_EVENT_MEMINFO_SESSIONWS, 0, 2u, &UserData);
          }
          ExFreePoolWithTag(v5, 0);
        }
      }
      ExFreePoolWithTag(v2, 0);
      return;
    }
  }
}

Referenced by: