EtwpLogProcessPerfCtrs
VOID __fastcall EtwpLogProcessPerfCtrs(_EPROCESS *Process){
INT64 v2;
__int64 ProcessServerSilo;
INT64 a6;
EVENT_DATA_DESCRIPTOR a2;
INT64 result[14];
memset((INT64)result, 0i64);
LODWORD(result[0]) = *((_DWORD *)Process + 272);
result[2] = *((_QWORD *)Process + 146);
result[3] = *((_QWORD *)Process + 228) << 12;
result[4] = *((_QWORD *)Process + 202) << 12;
result[5] = *((_QWORD *)Process + 145);
v2 = *((_QWORD *)Process + 144);
a2.Reserved = 0;
result[6] = v2;
a2.Size = 104;
a2.Ptr = (unsigned __int64)result;
ProcessServerSilo = PsGetProcessServerSilo((__int64)Process);
LODWORD(a6) = 5249026;
EtwTraceSiloKernelEvent(ProcessServerSilo, &a2, 1u, 1ui64, 800, a6);
}Referenced by:
No references.