EtwpCovSampEnumerateProcess

NTSTATUS __stdcall EtwpCovSampEnumerateProcess(PVOID BugCheckParameter1, _DOUBLE XMM1_8){
  int v2; 
  void *v3; 
  _QWORD *v5; 
  unsigned __int64 *v6; 
  unsigned __int64 v7; 
  __int64 v8; 
  unsigned __int64 v9; 
  __int64 v11; 
  _IMAGE_INFO ImageInfo; 
  __int128 v13; 
  unsigned __int64 v14; 
  _UNICODE_STRING FullImageName; 
  _KAPC_STATE ApcState; 

  v2 = 0;
  v11 = 0i64;
  v3 = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  v14 = 0i64;
  FullImageName = 0i64;
  memset(&ImageInfo, 0, sizeof(ImageInfo));
  v13 = 0i64;
  if( BugCheckParameter1 == PsInitialSystemProcess )
    return 0;
  if( BugCheckParameter1 == KeGetCurrentThread()->ApcState.Process )
    goto LABEL_5;
  if( ExAcquireRundownProtection((_EX_RUNDOWN_REF *)BugCheckParameter1 + 139) )
  {
    KiStackAttachProcess(BugCheckParameter1, 0i64, &ApcState);
    v2 = 1;
LABEL_5:
    v5 = MmEnumerateAddressSpaceAndReferenceImages((_EPROCESS *)BugCheckParameter1, 1);
    v3 = v5;
    if( v5 )
    {
      LODWORD(ImageInfo.ImageBase) |= 0x400u;
      v6 = v5;
      *(_QWORD *)&ImageInfo.anonymous_0.Properties = 56i64;
      v7 = *v5;
      if( *v5 )
      {
        v8 = v11;
        do
        {
          if( (v7 & 3) == 0 )
          {
            v9 = v7 & 0xFFFFFFFFFFFFFFFCui64;
            *v6 = v9;
            v14 = v9;
            *(_QWORD *)&ImageInfo.ImageSelector = v6[1] & 0xFFFFFFFFFFFF0000ui64;
            *(_QWORD *)&v13 = v6[3];
            if( *(&stru_140CF2E80 + 599)
              && (*(int(__fastcall **)(unsigned __int64, __int64, _UNICODE_STRING *, __int64 *))(*(&stru_140CF2E80 + 599)
                                                                                                + 24i64))(
                   v9,
                   1024i64,
                   &FullImageName,
                   &v11) >= 0 )
            {
              EtwpCovSampImageNotify(
                &FullImageName,
                *((_QWORD *)BugCheckParameter1 + 136),
                (PIMAGE_INFO)&ImageInfo.ImageBase);
            }
            v8 = v11;
          }
          if( v8 )
          {
            (*(void(**)(void))(*(&stru_140CF2E80 + 599) + 32i64))();
            v8 = 0i64;
            v11 = 0i64;
          }
          v6 += 6;
          v7 = *v6;
        }
        while( *v6 );
      }
    }
  }
  if( v3 )
    ExFreePoolWithTag(v3, 0);
  if( v2 )
  {
    KiUnstackDetachProcess(&ApcState, 0i64);
    ExReleaseRundownProtection((_EX_RUNDOWN_REF *)BugCheckParameter1 + 139);
  }
  return 0;
}

Referenced by: