KsepDsEventPoolAllocate
VOID __fastcall KsepDsEventPoolAllocate(
VOID *Address,
VOID *Caller,
_POOL_TYPE PoolType,
UINT64 NumberOfBytes,
UINT64 Tag){
UINT64 v5;
UINT64 UserDataCount;
struct _EVENT_DATA_DESCRIPTOR UserData;
VOID **v8;
int v9;
int v10;
_POOL_TYPE *v11;
int v12;
int v13;
UINT64 *v14;
int v15;
int v16;
UINT64 *p_Tag;
int v18;
int v19;
VOID *v20;
VOID *v21;
_POOL_TYPE v22;
UINT64 v23;
v23 = NumberOfBytes;
v22 = PoolType;
v21 = Caller;
v20 = Address;
v5 = *(_QWORD *)KseEtwHandle;
if( *(_QWORD *)KseEtwHandle )
{
if( EtwEventEnabled(
*(UINT64 *)KseEtwHandle,
(EVENT_DESCRIPTOR *)&KseDsEventPoolAllocate,
*(EVENT_DESCRIPTOR **)&PoolType) )
{
UserData.Reserved = 0;
v10 = 0;
v13 = 0;
v16 = 0;
v19 = 0;
UserData.Ptr = (unsigned __int64)&v20;
v8 = &v21;
UserData.Size = 8;
v11 = &v22;
v14 = &v23;
p_Tag = &Tag;
LODWORD(UserDataCount) = 5;
v9 = 8;
v12 = 4;
v15 = 8;
v18 = 4;
EtwWriteEx(v5, (EVENT_DESCRIPTOR *)&KseDsEventPoolAllocate, 0i64, 0i64, 0i64, 0i64, UserDataCount, &UserData);
}
}
}Referenced by:
KseDsHookExAllocatePool
KseDsHookExAllocatePoolWithTag