MmPerfLogSessionRundown
NTSTATUS __stdcall MmPerfLogSessionRundown(UINT64 LoggerId, UINT64 Start){
int v2;
INT16 v3;
VOID *v5;
unsigned int v6;
__int64 v7;
_QWORD *NextSession;
_QWORD *v9;
INT64 v11;
__int128 v12;
PGET_UPDATED_BUS_RESOURCE v13;
int v14;
int v15;
v14 = 12;
v13 = (PGET_UPDATED_BUS_RESOURCE)&v12;
v15 = 0;
v3 = (v2 != 0) + 588;
v5 = 0i64;
v6 = Start;
v12 = 0i64;
while( 1 )
{
NextSession = MmGetNextSession(v5);
v9 = NextSession;
if( !NextSession )
break;
v7 = NextSession[171];
LODWORD(v11) = 4200451;
DWORD2(v12) = *(_DWORD *)(v7 + 8);
*(_QWORD *)&v12 = v7;
EtwTraceSiloDcEvent(&v13, 1ui64, (PFN_WDFREGISTRYQUERYULONG *)LoggerId, v6, v3, v11);
v5 = v9;
}
return 0;
}Referenced by:
EtwpKernelTraceRundown