EtwpLogMemInfo

VOID __fastcall EtwpLogMemInfo(INT64 a1, INT64 a2){
  LPCGUID ActivityId; 
  UINT64 Flag; 
  UINT64 UserDataCount; 
  char v7; 
  _DWORD v8[47]; 
  EVENT_DATA_DESCRIPTOR UserData; 
  EVENT_DATA_DESCRIPTOR EventData; 
  INT64 v11; 
  int v12; 
  int v13; 
  v8[0] = 0;
  memset((INT64)&v8[3], 0i64);
  UserData.Reserved = 0;
  UserData.Ptr = (unsigned __int64)&v7;
  v7 = 8;
  ActivityId = (LPCGUID)v8;
  UserData.Size = 1;
  MmQueryMemoryListInformation(0i64, (UINT64)&v8[3], (UINT64 *)0xB0);
  EventData.Reserved = 0;
  v13 = 0;
  EventData.Ptr = (unsigned __int64)&v8[3];
  EventData.Size = 176;
  v11 = a2;
  v12 = 32;
  if( a1 )
  {
    LODWORD(Flag) = 4200451;
    LOWORD(ActivityId) = 624;
    EtwpLogKernelEvent(&EventData, *(_QWORD *)(a1 + 1080), *(unsigned int *)a1, 2u, (UINT64)ActivityId, Flag);
  }
  else
  {
    if( EtwpHostSiloState != -4516 && (*(_DWORD *)(EtwpHostSiloState + 4520) & 0x80000) != 0 )
    {
      LODWORD(UserDataCount) = 3;
      EtwWriteEx(
        EtwpMemoryProvRegHandle,
        (EVENT_DESCRIPTOR *)&KERNEL_MEM_EVENT_MEMINFO,
        0i64,
        0i64,
        0i64,
        0i64,
        UserDataCount,
        &UserData);
    }
    LODWORD(ActivityId) = 4200451;
    EtwTraceKernelEvent(&EventData, 2ui64, 0x20080000ui64, 0x270u, (UINT64)ActivityId);
  }
}

Referenced by: