EtwpAllocatePartitionMemory
VOID *__stdcall EtwpAllocatePartitionMemory(VOID **a1, UINT64 a2){
_MDL *PartitionNodePagesForMdl;
_MDL *v4;
VOID *v5;
UINT64 v6;
VOID *v7;
UINT64 CacheType;
UINT64 Priority;
UINT64 Prioritya;
UINT64 Flags;
LODWORD(Flags) = 5;
LODWORD(Priority) = 0;
PartitionNodePagesForMdl = MmAllocatePartitionNodePagesForMdlEx(
0i64,
(_LARGE_INTEGER)-1i64,
0i64,
a2,
MmCached,
Priority,
Flags,
*a1);
v4 = PartitionNodePagesForMdl;
if( !PartitionNodePagesForMdl )
return 0i64;
LODWORD(Prioritya) = 1073741856;
LODWORD(CacheType) = 0;
v5 = MmMapLockedPagesSpecifyCache(PartitionNodePagesForMdl, 0, MmCached, 0i64, CacheType, Prioritya);
v7 = v5;
if( !v5 )
{
LABEL_5:
MiFreePagesFromMdl(v4, 0i64, v6);
ExFreePoolWithTag(v4, 0);
return 0i64;
}
if( !EtwpRegisterPartitionPages((INT64)a1, (INT64)v4, (INT64)v5) )
{
MmUnmapLockedPages(v7, v4);
goto LABEL_5;
}
return v7;
}Referenced by:
EtwpAllocateTraceBuffer