EtwpLogMemInfoWs

VOID __stdcall EtwpLogMemInfoWs(UINT64 *LoggerId, UINT64 PagedPoolCommitPageCount){
  __int64 v3; 
  unsigned int v4; 
  unsigned int v5; 
  int v6; 
  _DWORD *PoolWithTag; 
  UINT8 *v8; 
  __int64 v9; 
  int *v10; 
  unsigned __int64 v11; 
  UINT64 v12; 
  _DWORD *NextProcess; 
  __int64 v14; 
  __int64 v15; 
  int v16; 
  int v17; 
  unsigned int v18; 
  UINT8 *v19; 
  UINT8 *v20; 
  unsigned __int64 v21; 
  unsigned __int64 v22; 
  unsigned __int64 v23; 
  int v24; 
  _DWORD *v25; 
  UINT64 StoreSizeInBytes; 
  UINT64 DataInStoreInBytes; 
  UINT64 *v28; 
  UINT64 v29; 
  unsigned __int64 SystemInformation[8]; 
  int v31[4]; 
  v29 = PagedPoolCommitPageCount;
  v28 = LoggerId;
  LODWORD(v3) = 64;
  v31[0] = 81;
  v31[1] = 119;
  v31[2] = 120;
  memset((INT64)SystemInformation, 0i64);
  v4 = 0;
  StoreSizeInBytes = 0i64;
  DataInStoreInBytes = 0i64;
  EtwpLogSessionWorkingSetInfo(LoggerId);
  v5 = 4356;
  v6 = -1;
  PoolWithTag = ExAllocatePoolWithTag(NonPagedPoolNx, 0x1104ui64, 0x74777445ui64);
  v8 = (UINT8 *)PoolWithTag;
  if( !PoolWithTag )
    return;
  v9 = (__int64)(PoolWithTag + 1);
  *PoolWithTag = 0;
  v25 = PoolWithTag + 1089;
  v10 = v31;
  do
  {
    v24 = *v10;
    if( (unsigned int)ZwQuerySystemInformation() )
      goto LABEL_31;
    *(_DWORD *)v9 = v6;
    v11 = SystemInformation[0] >> 12;
    *(_QWORD *)(v9 + 4) = SystemInformation[0] >> 12;
    *(_QWORD *)(v9 + 28) = v11;
    *(_QWORD *)(v9 + 12) = v11;
    *(_QWORD *)(v9 + 60) = 0i64;
    *(_QWORD *)(v9 + 20) = v11;
    *(_QWORD *)(v9 + 44) = 0i64;
    *(_QWORD *)(v9 + 36) = 0i64;
    *(_QWORD *)(v9 + 52) = 0i64;
    if( v24 == 119 )
    {
      v12 = v29;
      if( v29 > v11 )
      {
        *(_QWORD *)(v9 + 12) = v29;
        *(_QWORD *)(v9 + 20) = v12;
      }
    }
    ++*(_DWORD *)v8;
    v9 += 68i64;
    --v6;
    ++v4;
    ++v10;
  }
  while( v4 < 3 );
  NextProcess = PsIdleProcess;
  v14 = (__int64)v28;
  if( !PsIdleProcess )
  {
LABEL_30:
    EtwpLogMemInfoWsHelper(v14, v8);
    goto LABEL_31;
  }
  v15 = (__int64)v25;
  while( 1 )
  {
    v16 = NextProcess[281];
    if( (v16 & 0x4000000) != 0
      && ((v16 & 4) == 0 || !NextProcess[1] || NextProcess[380] || *((_DWORD **)NextProcess + 6) != NextProcess + 12) )
    {
      break;
    }
LABEL_27:
    if( NextProcess == PsIdleProcess )
      NextProcess = 0i64;
    NextProcess = (_DWORD *)PsGetNextProcess(NextProcess);
    if( !NextProcess )
      goto LABEL_30;
  }
  if( v9 != v15 )
  {
LABEL_20:
    *(_DWORD *)v9 = NextProcess[272];
    *(_QWORD *)(v9 + 4) = *((_QWORD *)NextProcess + 223);
    *(_QWORD *)(v9 + 28) = *((_QWORD *)NextProcess + 224);
    *(_QWORD *)(v9 + 12) = *((_QWORD *)NextProcess + 201);
    *(_QWORD *)(v9 + 60) = *((_QWORD *)NextProcess + 293);
    *(_QWORD *)(v9 + 20) = *((_QWORD *)NextProcess + 147) >> 12;
    v21 = *(_QWORD *)(v9 + 12);
    if( v21 >= *(_QWORD *)(v9 + 20) )
      v21 = *(_QWORD *)(v9 + 20);
    v22 = *(_QWORD *)(v9 + 4);
    *(_QWORD *)(v9 + 12) = v21;
    v23 = *(_QWORD *)(v9 + 28);
    if( v23 >= v22 )
      v23 = v22;
    *(_QWORD *)(v9 + 36) = 0i64;
    *(_QWORD *)(v9 + 44) = 0i64;
    *(_QWORD *)(v9 + 28) = v23;
    *(_QWORD *)(v9 + 52) = *((_QWORD *)NextProcess + 233);
    if( (int)SmProcessQueryStoreStats((_EPROCESS *)NextProcess, &StoreSizeInBytes, &DataInStoreInBytes) >= 0 )
    {
      *(_QWORD *)(v9 + 36) = StoreSizeInBytes >> 12;
      *(_QWORD *)(v9 + 44) = DataInStoreInBytes >> 12;
    }
    v9 += 68i64;
    ++*(_DWORD *)v8;
    goto LABEL_27;
  }
  if( (unsigned int)v3 >= 0x100 )
  {
    EtwpLogMemInfoWsHelper(v14, v8);
    *(_DWORD *)v8 = 0;
    v9 = (__int64)(v8 + 4);
    goto LABEL_20;
  }
  v17 = 68 * v3;
  v18 = v5;
  v3 = (unsigned int)(2 * v3);
  v5 += v17;
  v19 = (UINT8 *)ExAllocatePoolWithTag(NonPagedPoolNx, v5, 0x74777445ui64);
  v20 = v19;
  if( v19 )
  {
    memmove(v19, v8, v18);
    ExFreePoolWithTag(v8, 0);
    v8 = v20;
    v9 = (__int64)&v20[68 * *(unsigned int *)v20 + 4];
    v15 = (__int64)&v20[68 * v3 + 4];
    goto LABEL_20;
  }
  ObfDereferenceObjectWithTag(NextProcess, 0x6E457350ui64);
LABEL_31:
  ExFreePoolWithTag(v8, 0);
}

Referenced by: