EtwpBuildProcessEvent

__int64 __fastcall EtwpBuildProcessEvent(
        _EPROCESS *Process,
        __int16 a2,
        CHAR a3,
        __int64 a4,
        _ETW_OTHER_PROCESS_INFO *OtherInfo,
        __int64 a6,
        __int64 a7,
        _ETW_PACKAGE_IDENTITY *PackageInfo,
        _STRING *DestinationString,
        _UNICODE_STRING *CommandLine,
        __int64 a11){
  _STRING *v11; 
  _QWORD *v14; 
  int InheritedFromUniqueProcessId; 
  int *v16; 
  unsigned int v17; 
  unsigned __int64 v18; 
  _EWOW64PROCESS *WoW64Process; 
  int v20; 
  int v21; 
  __int64 v22; 
  VOID *v23; 
  _ETW_PACKAGE_IDENTITY *v24; 
  VOID *v25; 
  NTSTATUS v26; 
  __int64 *v27; 
  int v28; 
  unsigned __int8 *ImageFileName; 
  __int64 Length; 
  char v31; 
  _UNICODE_STRING *v32; 
  int v33; 
  __int64 v34; 
  __int64 v35; 
  unsigned int v36; 
  unsigned int PackageNameSize; 
  unsigned int v38; 
  __int64 v39; 
  unsigned int v40; 
  __int64 result; 
  _OBJECT_NAME_INFORMATION *v42; 
  unsigned __int8 *Buffer; 
  unsigned __int16 Machine; 
  __int64 v45; 
  VOID *TokenInformation; 
  __int16 v47; 
  CHAR v48; 

  v48 = a3;
  v47 = a2;
  v11 = DestinationString;
  TokenInformation = 0i64;
  RtlInitAnsiString(DestinationString, 0i64);
  v14 = (_QWORD *)a11;
  *(_QWORD *)a4 = Process;
  *(_DWORD *)(a4 + 8) = Process->UniqueProcessId;
  InheritedFromUniqueProcessId = (int)Process->InheritedFromUniqueProcessId;
  *v14 = 0i64;
  *(_DWORD *)(a4 + 12) = InheritedFromUniqueProcessId;
  *(_DWORD *)(a4 + 16) = MmGetSessionIdEx(Process);
  v16 = (int *)(a4 + 32);
  v17 = 4;
  *(_DWORD *)(a4 + 20) = Process->ExitStatus;
  v18 = Process->Pcb.DirectoryTableBase & 0xFFFFFFFFFFFFF000ui64;
  *(_DWORD *)(a4 + 32) = 0;
  *(_QWORD *)(a4 + 24) = v18;
  WoW64Process = Process->WoW64Process;
  if( WoW64Process && ((Machine = WoW64Process->Machine, Machine == 332) || Machine == 452) )
  {
    *v16 = 2;
    v20 = 6;
  }
  else
  {
    v20 = 4;
  }
  v21 = *v16;
  v22 = a6;
  if( (Process->Protection.Level & 7) != 0 )
    v21 = v20;
  *v16 = v21;
  *(_QWORD *)v22 = a4;
  *(_QWORD *)(v22 + 8) = 36i64;
  v23 = PsReferencePrimaryToken(Process);
  v24 = PackageInfo;
  v25 = v23;
  EtwpQueryTokenPackageInfo(v23, PackageInfo, (UINT64 *)(a4 + 32));
  v26 = SeQueryInformationToken(v25, TokenUser, &TokenInformation);
  ObFastDereferenceObject(&Process->Token, v25);
  if( v26 < 0 )
  {
    v28 = 4;
    TokenInformation = &EtwpNull;
    v27 = &EtwpNull;
  }
  else
  {
    v27 = (__int64 *)TokenInformation;
    *v14 = TokenInformation;
    v28 = 4 * *(unsigned __int8 *)(*v27 + 1) + 24;
  }
  *(_QWORD *)(v22 + 16) = v27;
  *(_DWORD *)(v22 + 28) = 0;
  ImageFileName = Process->ImageFileName;
  Length = -1i64;
  *(_DWORD *)(v22 + 24) = v28;
  do
    ++Length;
  while( ImageFileName[Length] );
  if( (_DWORD)Length == 14 )
  {
    v42 = Process->SeAuditProcessCreationInfo.ImageFileName;
    if( v42 )
    {
      if( *(_WORD *)v42 && RtlUnicodeStringToAnsiString(v11, (_UNICODE_STRING *)v42, 1u) >= 0 )
      {
        Length = v11->Length;
        Buffer = (unsigned __int8 *)v11->Buffer;
        ImageFileName = &Buffer[Length];
        while( ImageFileName != Buffer )
        {
          if( *--ImageFileName == 92 )
          {
            ++ImageFileName;
            break;
          }
        }
        LODWORD(Length) = (_DWORD)Buffer - (_DWORD)ImageFileName + Length;
      }
    }
  }
  *(_DWORD *)(v22 + 40) = Length;
  v31 = v48;
  *(_QWORD *)(v22 + 32) = ImageFileName;
  *(_DWORD *)(v22 + 44) = 0;
  *(_QWORD *)(v22 + 48) = &EtwpNull;
  *(_QWORD *)(v22 + 56) = 1i64;
  if( v31 )
    EtwpQueryProcessOtherInfo(Process, OtherInfo);
  else
    *OtherInfo = 0i64;
  v32 = CommandLine;
  CommandLine->Length = 0;
  if( Process->Peb )
  {
    if( v31 )
    {
      EtwpQueryProcessCommandLine(Process, v32);
      v33 = v32->Length;
      if( (_WORD)v33 )
      {
        v17 = 5;
        *(_QWORD *)(v22 + 64) = v32->Buffer;
        *(_DWORD *)(v22 + 72) = v33;
        *(_DWORD *)(v22 + 76) = 0;
      }
    }
  }
  v34 = 2i64 * v17;
  v35 = v17 + 1;
  v36 = v17 + 2;
  v35 *= 2i64;
  *(_QWORD *)(v22 + 8 * v34) = &EtwpNull;
  *(_QWORD *)(v22 + 8 * v34 + 8) = 2i64;
  PackageNameSize = v24->PackageNameSize;
  *(_QWORD *)(v22 + 8 * v35) = &v24->PackageName[4];
  *(_DWORD *)(v22 + 8 * v35 + 8) = PackageNameSize;
  *(_DWORD *)(v22 + 8 * v35 + 12) = 0;
  v38 = *(_DWORD *)v24->PackageName;
  v39 = v36;
  v40 = v36 + 1;
  v39 *= 2i64;
  *(_QWORD *)(v22 + 8 * v39) = &v24->ApplicationName[4];
  *(_QWORD *)(v22 + 8 * v39 + 8) = v38;
  if( v47 == 807 )
  {
    v45 = 2i64 * v40++;
    *(_QWORD *)(v22 + 8 * v45) = &Process->ExitTime;
    *(_QWORD *)(v22 + 8 * v45 + 8) = 8i64;
  }
  result = a7;
  *(_DWORD *)a7 = v40;
  return result;
}

Referenced by: