ExpQuerySystemPerformanceInformation
VOID __stdcall ExpQuerySystemPerformanceInformation(
UINT64 CapturedNumProcs,
PVOID SystemInformation,
UINT64 SystemInformationLength){
__int64 v3;
ULONG v4;
LARGE_INTEGER v5;
ULONG v6;
LARGE_INTEGER v7;
ULONG v8;
LARGE_INTEGER v9;
_KPRCB **v10;
__int64 v11;
__int64 v12;
int v13;
int v14;
int v15;
_KPRCB **v16;
__int64 v17;
__int64 v18;
UINT64 AvailablePages;
UINT64 v20;
UINT64 TotalCommittedPages;
UINT64 v22;
UINT64 v23;
UINT64 TotalCommitLimit;
UINT64 v25;
UINT64 v26;
UINT64 PeakCommitment;
int v28;
unsigned int v29;
UINT64 v30;
int v31;
int v32;
int v33;
int v34;
int v35;
int v36;
int v37;
int v38;
int v39;
int v40;
int v41;
int v42;
_KPRCB **v43;
int v44;
_DWORD *v45;
CHAR *WorkingSetLeafSize;
CHAR *v47;
unsigned __int64 v48;
UINT64 v49;
UINT64 v50;
int v51;
ULONG v52;
unsigned int v53;
unsigned int v54;
int v55;
unsigned int v56;
unsigned int v57;
unsigned int v58;
unsigned int v59;
unsigned int v60;
unsigned int v61;
int v62;
_KPRCB **v63;
_KPRCB *v64;
int v65;
bool v66;
__int64 v67;
UINT64 v68;
int v69;
int v70;
int v71;
__int64 v72;
__int64 v73;
__int64 Src[4];
ULONG v75;
ULONG v76;
ULONG v77;
int v78;
int v79;
int v80;
int v81;
int v82;
int v83;
int v84;
int v85;
int v86;
int v87;
int v88;
int v89;
int v90;
int v91;
int v92;
int v93;
int v94;
__int128 v95;
__int64 v96;
int NumberOfFreeSystemPtes;
unsigned int SystemCodePage;
int TotalSystemDriverPages;
int TotalSystemCodePages;
__int64 v101;
int v102;
int v103;
int v104;
unsigned int SystemDriverPage;
INT64 result;
unsigned __int64 v107;
int v108;
ULONG v109;
unsigned __int64 v110;
unsigned __int64 v111;
unsigned __int64 v112;
__int64 v113;
__int64 v114;
__int64 v115;
__int64 v116;
__int64 v117;
__int64 v118;
__int64 v119;
__int64 v120;
__int64 v121;
int v122;
__int64 v123;
int v124;
__int128 v125;
__int128 v126;
_KPRCB **v127;
_MM_SYSTEM_PAGE_COUNTS PageCounts;
int v129[18];
unsigned int v130;
unsigned int Size;
unsigned __int16 ProcessPartitionId;
Size = SystemInformationLength;
v130 = CapturedNumProcs;
v3 = (unsigned int)CapturedNumProcs;
v81 = 0;
v96 = 0i64;
v101 = 0i64;
v95 = 0i64;
memset((INT64)&result, 0i64);
v4 = IoOtherOperationCount;
v5 = IoOtherTransferCount;
v6 = IoReadOperationCount;
v7 = IoReadTransferCount;
v8 = IoWriteOperationCount;
v9 = IoWriteTransferCount;
v127 = &KiProcessorBlock;
v125 = 0i64;
v126 = 0i64;
PageCounts = 0i64;
if( (_DWORD)v3 )
{
v10 = &KiProcessorBlock;
v11 = (unsigned int)v3;
do
{
v12 = (__int64)*v10++;
v4 += *(_DWORD *)(v12 + 11620);
v6 += *(_DWORD *)(v12 + 11612);
v8 += *(_DWORD *)(v12 + 11616);
v9.QuadPart += *(_QWORD *)(v12 + 11632);
v5.QuadPart += *(_QWORD *)(v12 + 11640);
v7.QuadPart += *(_QWORD *)(v12 + 11624);
--v11;
}
while( v11 );
}
v75 = v6;
v13 = 0;
Src[2] = v9.QuadPart;
v14 = 0;
Src[1] = v7.QuadPart;
v15 = 0;
Src[3] = v5.QuadPart;
v76 = v8;
v77 = v4;
if( (_DWORD)v3 )
{
v16 = &KiProcessorBlock;
v17 = v3;
do
{
v18 = (__int64)*v16++;
v15 += *(_DWORD *)(v18 + 11580);
v14 += *(_DWORD *)(v18 + 11576);
--v17;
}
while( v17 );
}
v122 = v15;
v123 = 0i64;
v124 = v14;
ProcessPartitionId = MmGetProcessPartitionId(*((_QWORD *)KeGetCurrentThread() + 23));
AvailablePages = MmGetAvailablePages(ProcessPartitionId);
if( AvailablePages > 0xFFFFFFFF )
v78 = -1;
else
v78 = AvailablePages;
TotalCommittedPages = MmGetTotalCommittedPages(v20);
if( TotalCommittedPages > v23 )
v79 = v23;
else
v79 = TotalCommittedPages;
TotalCommitLimit = MmGetTotalCommitLimit(v22);
if( TotalCommitLimit > v26 )
v80 = v26;
else
v80 = TotalCommitLimit;
PeakCommitment = MmGetPeakCommitment(v25);
if( PeakCommitment > v30 )
LODWORD(PeakCommitment) = v30;
v81 = PeakCommitment;
if( (unsigned int)PeakCommitment < v29 )
v81 = v28;
v31 = 0;
v32 = 0;
v33 = 0;
v34 = 0;
v35 = 0;
v36 = 0;
v37 = 0;
v38 = 0;
v39 = 0;
v40 = 0;
v41 = 0;
v69 = 0;
v42 = 0;
v70 = 0;
v71 = 0;
if( v130 )
{
v43 = &KiProcessorBlock;
v72 = v130;
v44 = 0;
do
{
v45 = *v43++;
v31 += v45[2884];
v32 += v45[2885];
v33 += v45[2886];
v34 += v45[8186];
v35 += v45[2887];
v36 += v45[2888];
v37 += v45[2889];
v38 += v45[8187];
v39 += v45[8188];
v44 += v45[2890];
v69 += v45[2891];
v70 += v45[2892];
v71 += v45[2893];
--v72;
}
while( v72 );
v40 = v69;
v41 = v70;
v42 = v71;
}
else
{
v44 = 0;
}
v82 = v31;
v83 = v32;
v84 = v33;
v85 = v34;
v86 = v35;
v87 = v36;
v88 = v37;
v89 = v38;
v90 = v39;
v91 = v44;
v92 = v40;
v93 = v41;
v94 = v42;
NumberOfFreeSystemPtes = MmGetNumberOfFreeSystemPtes();
MmGetSystemPageCounts(&PageCounts);
SystemCodePage = PageCounts.SystemCodePage;
WorkingSetLeafSize = MmGetWorkingSetLeafSize(2i64);
if( (unsigned __int64)WorkingSetLeafSize > 0xFFFFFFFF )
LODWORD(WorkingSetLeafSize) = -1;
v103 = (int)WorkingSetLeafSize;
v47 = MmGetWorkingSetLeafSize(3i64);
if( (unsigned __int64)v47 > v48 )
LODWORD(v47) = v48;
v104 = (int)v47;
SystemDriverPage = PageCounts.SystemDriverPage;
TotalSystemCodePages = PageCounts.TotalSystemCodePages;
TotalSystemDriverPages = PageCounts.TotalSystemDriverPages;
MiFreePoolPagesLeft(6i64);
v49 = MiMaximumCommitmentAvailable();
if( v50 > v49 )
LODWORD(v50) = v49;
v102 = v50;
Src[0] = KeMaximumIncrement * (unsigned __int64)(unsigned int)PsQueryRuntimeProcess((__int64)PsIdleProcess, v129);
ExQueryPoolUsage(
&v95,
(_DWORD *)&v95 + 1,
(_DWORD *)&v95 + 2,
(_DWORD *)&v95 + 3,
(_DWORD *)&v101 + 1,
&v96,
(_DWORD *)&v96 + 1,
&v101);
v51 = 0;
v52 = CcFastMdlReadWait;
v53 = 0;
result = 0i64;
v54 = 0;
v107 = 0i64;
v55 = 0;
v108 = 0;
v56 = 0;
v109 = CcFastMdlReadWait;
v57 = 0;
v110 = 0i64;
v58 = 0;
v111 = 0i64;
v59 = 0;
v112 = 0i64;
v60 = 0;
v113 = 0i64;
v61 = 0;
v114 = 0i64;
v62 = 0;
v115 = 0i64;
v116 = 0i64;
v117 = 0i64;
v118 = 0i64;
v119 = 0i64;
v120 = 0i64;
v121 = 0i64;
if( v130 )
{
v73 = v130;
v63 = &KiProcessorBlock;
do
{
v64 = *v63;
LODWORD(result) = *((_DWORD *)v64 + 2897) + v13;
HIDWORD(v113) += *((_DWORD *)v64 + 8166);
v51 += *((_DWORD *)v64 + 2898);
v53 += *((_DWORD *)v64 + 8176);
v54 += *((_DWORD *)v64 + 2899);
v55 += *((_DWORD *)v64 + 8160);
v52 += *((_DWORD *)v64 + 8161);
v56 += *((_DWORD *)v64 + 8178);
v57 += *((_DWORD *)v64 + 8162);
v58 += *((_DWORD *)v64 + 8163);
v59 += *((_DWORD *)v64 + 8164);
v60 += *((_DWORD *)v64 + 8179);
v61 += *((_DWORD *)v64 + 8180);
v62 += *((_DWORD *)v64 + 8165);
LODWORD(v114) = *((_DWORD *)v64 + 8167) + v114;
HIDWORD(v114) += *((_DWORD *)v64 + 8181);
LODWORD(v115) = *((_DWORD *)v64 + 8182) + v115;
HIDWORD(v115) += *((_DWORD *)v64 + 2900);
LODWORD(v116) = *((_DWORD *)v64 + 2901) + v116;
HIDWORD(v116) += *((_DWORD *)v64 + 2902);
LODWORD(v117) = *((_DWORD *)v64 + 8177) + v117;
HIDWORD(v117) += *((_DWORD *)v64 + 8168);
LODWORD(v118) = *((_DWORD *)v64 + 8169) + v118;
HIDWORD(v118) += *((_DWORD *)v64 + 8183);
LODWORD(v119) = *((_DWORD *)v64 + 8184) + v119;
HIDWORD(v119) += *((_DWORD *)v64 + 8185);
LODWORD(v120) = *((_DWORD *)v64 + 8171) + v120;
HIDWORD(v120) += *((_DWORD *)v64 + 8172);
LODWORD(v121) = *((_DWORD *)v64 + 8173) + v121;
v65 = *((_DWORD *)v64 + 8174) + HIDWORD(v121);
v63 = v127 + 1;
HIDWORD(v121) = v65;
v66 = v73-- == 1;
v13 = result;
++v127;
}
while( !v66 );
HIDWORD(result) = v51;
v107 = __PAIR64__(v54, v53);
v108 = v55;
v109 = v52;
v110 = __PAIR64__(v57, v56);
v111 = __PAIR64__(v59, v58);
v112 = __PAIR64__(v61, v60);
LODWORD(v113) = v62;
}
v125 = *(_OWORD *)CcSystemPartitionDirtyPageStatistics;
MmGetResidentAvailablePages((_BYTE *)ProcessPartitionId);
*(_QWORD *)&v126 = v67;
*((_QWORD *)&v126 + 1) = MmGetSharedCommit(v68);
memmove((UINT8 *)SystemInformation, (UINT8 *)Src, Size);
}Referenced by:
ExpQuerySystemInformation