EtwpProcessPerfCtrsRundown

VOID __fastcall EtwpProcessPerfCtrsRundown(_EPROCESS *Process, UINT64 LoggerId){
  __int64 v4; 
  UINT64 v5; 
  UINT64 v6; 
  UINT64 Flag; 
  UINT64 v8; 
  int v9[4]; 
  __int64 v10; 
  __int64 v11; 
  __int64 v12; 
  __int64 v13; 
  __int64 v14; 
  __int64 v15; 
  __int64 v16; 
  __int64 v17; 
  __int64 v18; 
  __int64 v19; 
  __int64 v20; 
  EVENT_DATA_DESCRIPTOR EventData; 
  v9[3] = 0;
  v9[0] = *((_DWORD *)Process + 272);
  v9[2] = ObGetProcessHandleCount((struct _EX_RUNDOWN_REF *)Process, 0i64);
  v9[1] = *((_DWORD *)Process + 417);
  v15 = *((_QWORD *)Process + 147);
  v10 = *((_QWORD *)Process + 146);
  v16 = *((_QWORD *)Process + 223) << 12;
  v11 = *((_QWORD *)Process + 228) << 12;
  v18 = *((_QWORD *)Process + 143);
  v13 = *((_QWORD *)Process + 145);
  v19 = *((_QWORD *)Process + 142);
  v14 = *((_QWORD *)Process + 144);
  v17 = *((_QWORD *)Process + 201) << 12;
  v4 = *((_QWORD *)Process + 202);
  EventData.Reserved = 0;
  v5 = *(unsigned int *)LoggerId;
  v6 = *(_QWORD *)(LoggerId + 1080);
  v12 = v4 << 12;
  v20 = v17;
  EventData.Ptr = (unsigned __int64)v9;
  LODWORD(v8) = 4200450;
  LOWORD(Flag) = 801;
  EventData.Size = 104;
  EtwpLogKernelEvent(&EventData, v6, v5, 1u, Flag, v8);
}

Referenced by: