EtwpPoolRunDown
VOID __stdcall EtwpPoolRunDown(UINT64 LoggerId, UINT8 Start){
_DWORD *v2;
UINT8 v3;
unsigned int v5;
__int16 v6;
_DWORD *PoolWithTag;
NTSTATUS PoolTagInfo;
unsigned int v9;
__int64 v10;
UINT64 v11;
UINT64 v12;
int v13;
unsigned int v14;
_DWORD *v15;
NTSTATUS BigPoolInfo;
unsigned int v17;
__int64 v18;
UINT64 v19;
UINT64 v20;
int v21;
void *i;
unsigned int v23;
unsigned int v24;
_DWORD *v25;
NTSTATUS SessionPoolTagInfo;
unsigned int v27;
__int64 v28;
UINT64 v29;
UINT64 v30;
int v31;
unsigned int v32;
_DWORD *v33;
NTSTATUS v34;
unsigned int v35;
__int64 v36;
UINT64 v37;
UINT64 v38;
int v39;
void *v40;
void *v41;
UINT64 Flag;
UINT64 v43;
UINT64 ReturnedEntries;
int SessionId;
UINT64 ActualEntries;
KAPC_STATE ApcState;
EVENT_DATA_DESCRIPTOR EventData;
int *p_SessionId;
int v51;
int v52;
__int64 v53;
int v54;
int v55;
LODWORD(ActualEntries) = 0;
ReturnedEntries = 0x3000000000i64;
v2 = 0i64;
SessionId = 0;
EventData.Reserved = 0;
v3 = Start;
EventData.Ptr = (unsigned __int64)&ReturnedEntries;
EventData.Size = 4;
v5 = 48;
v6 = 3625 - (Start != 0);
memset(&ApcState, 0, sizeof(ApcState));
while( 1 )
{
if( v2 )
ExFreePoolWithTag(v2, 0);
PoolWithTag = ExAllocatePoolWithTag(PagedPool, v5, 0x74777445ui64);
v2 = PoolWithTag;
if( !PoolWithTag )
break;
PoolTagInfo = ExGetPoolTagInfo(PoolWithTag, v5, (UINT64 *)((char *)&ReturnedEntries + 4));
if( PoolTagInfo != -1073741820 )
{
if( PoolTagInfo >= 0 )
{
v9 = *v2;
v10 = (__int64)(v2 + 2);
if( *v2 )
{
do
{
v11 = *(unsigned int *)LoggerId;
v12 = *(_QWORD *)(LoggerId + 1080);
v13 = v9;
LODWORD(v43) = 4200450;
p_SessionId = (int *)v10;
if( v9 > 0x64 )
v13 = 100;
LOWORD(Flag) = v6;
v52 = 0;
LODWORD(ReturnedEntries) = v13;
v51 = 40 * v13;
EtwpLogKernelEvent(&EventData, v12, v11, 2u, Flag, v43);
v10 += 40i64 * (unsigned int)ReturnedEntries;
v9 -= ReturnedEntries;
}
while( v9 );
v3 = Start;
}
}
break;
}
v5 = HIDWORD(ReturnedEntries);
}
v14 = 32;
for( HIDWORD(ReturnedEntries) = 32; ; v14 = HIDWORD(ReturnedEntries) )
{
if( v2 )
ExFreePoolWithTag(v2, 0);
v15 = ExAllocatePoolWithTag(PagedPool, v14, 0x74777445ui64);
v2 = v15;
if( !v15 )
break;
BigPoolInfo = ExGetBigPoolInfo(v15, v14, 1ui64, (UINT64 *)((char *)&ReturnedEntries + 4));
if( BigPoolInfo != -1073741820 )
{
if( BigPoolInfo >= 0 )
{
v17 = *v2;
v18 = (__int64)(v2 + 2);
if( *v2 )
{
do
{
v19 = *(unsigned int *)LoggerId;
v20 = *(_QWORD *)(LoggerId + 1080);
v21 = v17;
LODWORD(v43) = 4200450;
p_SessionId = (int *)v18;
if( v17 > 0x64 )
v21 = 100;
LOWORD(Flag) = 3627 - (v3 != 0);
v52 = 0;
LODWORD(ReturnedEntries) = v21;
v51 = 24 * v21;
EtwpLogKernelEvent(&EventData, v20, v19, 2u, Flag, v43);
v18 += 24i64 * (unsigned int)ReturnedEntries;
v17 -= ReturnedEntries;
}
while( v17 );
v3 = Start;
}
}
break;
}
}
for( i = 0i64; ; i = v41 )
{
LODWORD(v40) = MmGetNextSession(i);
v41 = v40;
if( !v40 )
break;
if( MmAttachSession(v40, &ApcState) >= 0 )
{
SessionId = MmGetSessionId((__int64)v41);
v23 = 4000;
v24 = 4000;
while( 1 )
{
if( v2 )
ExFreePoolWithTag(v2, 0);
v25 = ExAllocatePoolWithTag(PagedPool, v24, 0x74777445ui64);
v2 = v25;
if( !v25 )
break;
SessionPoolTagInfo = ExGetSessionPoolTagInfo(v25, v23, &ReturnedEntries, &ActualEntries);
v23 = 40 * ActualEntries;
v24 = 40 * ActualEntries;
if( SessionPoolTagInfo != -1073741820 )
{
if( SessionPoolTagInfo >= 0 )
{
v52 = 0;
v27 = ReturnedEntries;
v28 = (__int64)v2;
p_SessionId = &SessionId;
v51 = 4;
if( (_DWORD)ReturnedEntries )
{
do
{
v29 = *(unsigned int *)LoggerId;
v30 = *(_QWORD *)(LoggerId + 1080);
v31 = v27;
LODWORD(v43) = 4200450;
v53 = v28;
if( v27 > 0x64 )
v31 = 100;
LOWORD(Flag) = 3629 - (v3 != 0);
v55 = 0;
LODWORD(ReturnedEntries) = v31;
v54 = 40 * v31;
EtwpLogKernelEvent(&EventData, v30, v29, 3u, Flag, v43);
v28 += 40i64 * (unsigned int)ReturnedEntries;
v27 -= ReturnedEntries;
}
while( v27 );
v3 = Start;
}
}
break;
}
}
v32 = 40;
for( HIDWORD(ReturnedEntries) = 40; ; v32 = HIDWORD(ReturnedEntries) )
{
if( v2 )
ExFreePoolWithTag(v2, 0);
v33 = ExAllocatePoolWithTag(PagedPool, v32, 0x74777445ui64);
v2 = v33;
if( !v33 )
break;
v34 = ExGetBigPoolInfo(v33, v32, 0i64, (UINT64 *)((char *)&ReturnedEntries + 4));
if( v34 != -1073741820 )
{
if( v34 >= 0 )
{
v52 = 0;
v35 = v2[3];
v36 = (__int64)(v2 + 4);
p_SessionId = &SessionId;
v51 = 4;
if( v35 )
{
do
{
v37 = *(unsigned int *)LoggerId;
v38 = *(_QWORD *)(LoggerId + 1080);
v39 = v35;
LODWORD(v43) = 4200450;
v53 = v36;
if( v35 > 0x64 )
v39 = 100;
LOWORD(Flag) = 3631 - (v3 != 0);
v55 = 0;
LODWORD(ReturnedEntries) = v39;
v54 = 24 * v39;
EtwpLogKernelEvent(&EventData, v38, v37, 3u, Flag, v43);
v36 += 24i64 * (unsigned int)ReturnedEntries;
v35 -= ReturnedEntries;
}
while( v35 );
v3 = Start;
}
}
break;
}
}
MmDetachSession(v41, &ApcState);
}
}
if( v2 )
ExFreePoolWithTag(v2, 0);
}Referenced by:
EtwpKernelTraceRundown