EtwpPsProvProcessEnumCallback

NTSTATUS __stdcall EtwpPsProvProcessEnumCallback(_EPROCESS *Process, VOID *Context){
  char v4; 
  _EPROCESS *v5; 
  bool v6; 
  VOID *v7; 
  UINT64 ProcessInfoFlags; 
  _ETW_OTHER_PROCESS_INFO OtherInfo; 
  _KAPC_STATE ApcState; 
  char PackageInfo[408]; 

  OtherInfo = 0i64;
  v4 = 0;
  memset(&ApcState, 0, sizeof(ApcState));
  memset(PackageInfo, 0i64, sizeof(PackageInfo));
  if( !(unsigned int)EtwpIsProcessZombie(Process) )
  {
    if( *((_BYTE *)Context + 9) )
    {
      if( (*(_BYTE *)Context & 1) != 0 && Process != *(_EPROCESS **)&PsIdleProcess && (Process->Flags3 & 0x1000) == 0 )
        PsSetProcessTelemetryAppState(v5, PsTelemetryAppStateHeartbeat);
    }
    else
    {
      v6 = Process == *(_EPROCESS **)&PsIdleProcess;
      *((_BYTE *)Context + 8) = 0;
      if( !v6
        && KeGetCurrentThread()->ApcState.Process != Process
        && ExAcquireRundownProtection(&Process->RundownProtect) )
      {
        KiStackAttachProcess(Process, 0i64, &ApcState);
        v4 = 1;
        *((_BYTE *)Context + 8) = 1;
      }
      if( (*(_BYTE *)Context & 0x10) != 0 )
      {
        LODWORD(ProcessInfoFlags) = 0;
        v7 = PsReferencePrimaryToken(Process);
        EtwpQueryTokenPackageInfo(v7, (_ETW_PACKAGE_IDENTITY *)PackageInfo, &ProcessInfoFlags);
        if( *((_BYTE *)Context + 8) )
          EtwpQueryProcessOtherInfo(Process, &OtherInfo);
        ObFastDereferenceObject(&Process->Token, v7);
        EtwpPsProvTraceProcess(
          Process,
          (unsigned int)ProcessInfoFlags,
          (_ETW_PACKAGE_IDENTITY *)PackageInfo,
          &OtherInfo,
          0x303u);
      }
      if( v4 )
      {
        KiUnstackDetachProcess(&ApcState, 0i64);
        ExReleaseRundownProtection(&Process->RundownProtect);
      }
    }
  }
  return 0;
}

Referenced by: