EtwpProcessEnumCallback

NTSTATUS __stdcall EtwpProcessEnumCallback(ULONG_PTR Process, VOID *Context){
  UINT64 *v2; 
  UINT8 v3; 
  PERFINFO_GROUPMASK *v5; 
  _EPROCESS *v6; 
  char v7; 
  char v8; 
  _EJOB *v9; 
  _EPROCESS *v10; 
  _ETHREAD *v11; 
  char v12; 
  PERFINFO_GROUPMASK v13; 
  PERFINFO_GROUPMASK v14; 
  PERFINFO_GROUPMASK v16; 
  PERFINFO_GROUPMASK v17; 
  unsigned int v18; 
  unsigned int i; 
  _KPRCB *Prcb; 
  unsigned int v21; 
  unsigned int j; 
  _KPRCB *v23; 
  _ESERVERSILO_GLOBALS *ServerSiloGlobals; 
  _ETW_SILODRIVERSTATE *v25; 
  _KAPC_STATE ApcState; 

  v2 = (UINT64 *)*((_QWORD *)Context + 4);
  v3 = *((_BYTE *)Context + 64);
  v5 = *(PERFINFO_GROUPMASK **)Context;
  v6 = *(_EPROCESS **)&Process;
  memset(&ApcState, 0, sizeof(ApcState));
  v7 = 0;
  v8 = 0;
  LODWORD(v9) = PsGetProcessServerSilo(*(INT64 *)&Process);
  if( v2[135] != EtwpHostSiloState )
  {
    ServerSiloGlobals = PsGetServerSiloGlobals(v9);
    if( ServerSiloGlobals->EtwSiloState != v25 )
      return 0;
  }
  *((_BYTE *)Context + 65) = 0;
  if( !(unsigned int)EtwpIsProcessZombie(v6) )
  {
    v12 = 1;
    if( v6 == *(_EPROCESS **)&PsIdleProcess )
    {
      v8 = 1;
    }
    else
    {
      if( KeGetCurrentThread()->ApcState.Process == v6 )
      {
LABEL_7:
        *((_BYTE *)Context + 65) = v12;
        *((_BYTE *)Context + 67) = v8;
        if( v5 )
        {
          if( v3 )
          {
            v16 = *v5;
            if( (*v5 & 1) != 0 )
            {
              EtwpTraceProcessRundown(v6, v2, 0x303u, (_ETW_RUNDOWN_CONTEXT *)Context);
              v16 = *v5;
            }
            if( (v16 & 2) != 0 )
            {
              if( v6 == *(_EPROCESS **)&PsIdleProcess )
              {
                v18 = KeNumberProcessors_0;
                for( i = 0; i < v18; ++i )
                {
                  Prcb = KeGetPrcb(i);
                  EtwpThreadEnumCallback(v6, Prcb->IdleThread, Context);
                }
              }
              else
              {
                PsEnumProcessThreads(
                  v6,
                  (INT64 *)EtwpThreadEnumCallback,
                  (_EPROCESS *)Context,
                  v11,
                  ApcState.ApcListHead[0].Flink,
                  ApcState.ApcListHead[0].Blink);
              }
            }
            v17 = *v5;
            if( (*v5 & 0xC004) != 0 )
            {
              EtwpEnumerateAddressSpace(v6, (_ETW_RUNDOWN_CONTEXT *)Context, v5);
              v17 = *v5;
            }
            if( (v17 & 4) != 0 && v6 == PsInitialSystemProcess )
              EtwpSysModuleRunDown((UINT64)v2, v3);
            if( (v5[1] & 0x8000000) != 0 )
              EtwpEnumerateWorkingSet(v6, (_ETW_RUNDOWN_CONTEXT *)Context);
          }
          else
          {
            if( (v5[1] & 0x8000000) != 0 )
              EtwpEnumerateWorkingSet(v6, (_ETW_RUNDOWN_CONTEXT *)Context);
            v13 = *v5;
            if( (*v5 & 4) != 0 && v6 == PsInitialSystemProcess )
            {
              EtwpSysModuleRunDown((UINT64)v2, 0);
              v13 = *v5;
            }
            if( (v13 & 0xC004) != 0 )
              EtwpEnumerateAddressSpace(v6, (_ETW_RUNDOWN_CONTEXT *)Context, v5);
            if( (v5[4] & 0x40) != 0 && v6 != *(_EPROCESS **)&PsIdleProcess )
              EtwpObjectHandleRundown(v6, (_ETW_RUNDOWN_CONTEXT *)Context);
            if( (*v5 & 2) != 0 )
            {
              if( v6 == *(_EPROCESS **)&PsIdleProcess )
              {
                v21 = KeNumberProcessors_0;
                for( j = 0; j < v21; ++j )
                {
                  v23 = KeGetPrcb(j);
                  EtwpThreadEnumCallback(v6, v23->IdleThread, Context);
                }
              }
              else
              {
                PsEnumProcessThreads(
                  v6,
                  (INT64 *)EtwpThreadEnumCallback,
                  (_EPROCESS *)Context,
                  v11,
                  ApcState.ApcListHead[0].Flink,
                  ApcState.ApcListHead[0].Blink);
              }
            }
            v14 = *v5;
            if( (*v5 & 8) != 0 )
            {
              EtwpProcessPerfCtrsRundown(v6, (UINT64)v2);
              v14 = *v5;
            }
            if( (v14 & 1) != 0 )
              EtwpTraceProcessRundown(v6, v2, 0x304u, (_ETW_RUNDOWN_CONTEXT *)Context);
          }
        }
        if( v7 )
        {
          KiUnstackDetachProcess(&ApcState, 0i64);
          ExReleaseRundownProtection(&v6->RundownProtect);
        }
        return 0;
      }
      if( ExAcquireRundownProtection(&v6->RundownProtect) )
      {
        KiStackAttachProcess(v6, 0i64, &ApcState);
        v7 = 1;
        goto LABEL_7;
      }
    }
    v12 = 0;
    goto LABEL_7;
  }
  if( v5 && (*v5 & 1) != 0 && !v3 )
    EtwpTraceProcessRundown(v10, v2, 0x327u, (_ETW_RUNDOWN_CONTEXT *)Context);
  return 0;
}

Referenced by: