PfSnBeginAppLaunch

NTSTATUS __stdcall PfSnBeginAppLaunch(_EPROCESS *Process, _UNICODE_STRING *ImageName, UINT64 LaunchTypeId){
  int v3; 
  _UNICODE_STRING *v6; 
  unsigned int v7; 
  int v8; 
  WCHAR *ImageFileName; 
  __int64 v10; 
  __int64 v11; 
  unsigned int ImagePathHash; 
  UINT8 IsHostingApplication; 
  int v14; 
  NTSTATUS v16; 
  UINT64 HashId; 
  _UNICODE_STRING *FullImageName; 
  UINT64 NameNumCharsOut; 
  _PF_ENABLE_STATUS EnableStatus; 
  VOID *v21[2]; 
  WCHAR ExecutableName[32]; 
  UINT64 a3[32]; 

  v3 = LaunchTypeId;
  EnableStatus = PfSvDefaultDisabled;
  NameNumCharsOut = 0i64;
  FullImageName = 0i64;
  LODWORD(HashId) = 0;
  v6 = 0i64;
  memset(ExecutableName, 0i64, sizeof(ExecutableName));
  v7 = 0;
  v8 = PfSnCheckScenario(PfAppLaunchScenarioType, &EnableStatus);
  if( v8 < 0 )
    goto LABEL_17;
  if( !ImageName )
  {
    v16 = PfCalculateProcessHash(Process, &FullImageName);
    v6 = FullImageName;
    v8 = v16;
    if( v16 < 0 )
    {
LABEL_17:
      PfSnLogScenarioDecision((__int64)ExecutableName, 0, 0, 15, 15, v8, -1i64);
      goto LABEL_14;
    }
    ImageName = FullImageName;
  }
  *(_UNICODE_STRING *)v21 = *ImageName;
  ImageFileName = PfSnFindImageFileName(ImageName, &NameNumCharsOut);
  if( !ImageFileName )
  {
    v8 = -1073741811;
    goto LABEL_17;
  }
  v10 = (unsigned int)NameNumCharsOut;
  if( (unsigned int)NameNumCharsOut >= 0x1D )
    v10 = 29i64;
  v11 = v10;
  memmove(ExecutableName, ImageFileName, 2 * v10);
  ImagePathHash = Process->ImagePathHash;
  ExecutableName[v11] = 0;
  *(_DWORD *)&ExecutableName[30] = ImagePathHash;
  IsHostingApplication = PfSnIsHostingApplication(ExecutableName);
  v8 = PfSnScanCommandLine(&HashId, IsHostingApplication);
  if( v8 < 0 )
    goto LABEL_17;
  *(_DWORD *)&ExecutableName[30] += HashId;
  FullImageName = (_UNICODE_STRING *)256;
  v8 = PfSnCheckModernApp((UINT64 *)((char *)&NameNumCharsOut + 4), &HashId, (UINT64)a3);
  if( v8 < 0 )
    goto LABEL_17;
  v14 = *(_DWORD *)&ExecutableName[30];
  if( HIDWORD(NameNumCharsOut) )
  {
    v14 = HashId + *(_DWORD *)&ExecutableName[30];
    v21[1] = a3;
    v7 = 8;
    LOWORD(v21[0]) = (_WORD)FullImageName;
    WORD1(v21[0]) = (_WORD)FullImageName;
  }
  *(_DWORD *)&ExecutableName[30] = v3 + v14;
  if( (dword_140C50290 & 0x20) != 0 || EnableStatus == PfSvTraceOnly )
    v7 |= 2u;
  v8 = PfSnBeginScenario(Process, ExecutableName, 0, v7, v21);
  if( v8 >= 0 )
    v8 = 0;
LABEL_14:
  if( v6 )
    ExFreePoolWithTag(v6, 0);
  return v8;
}

Referenced by: