PfSnOperationProcess

INT64 __fastcall PfSnOperationProcess(INT64 a1){
  bool v2; 
  PVOID v3; 
  unsigned __int8 v4; 
  unsigned int v5; 
  bool v6; 
  void *v7; 
  int v8; 
  unsigned int v9; 
  int v10; 
  int v11; 
  int v13; 
  PVOID P; 
  UINT64 NameNumCharsOut[2]; 
  wchar_t pszDest[30]; 
  int v17; 
  memset((INT64)pszDest, 0i64);
  v2 = *(_BYTE *)a1 == 1;
  v3 = 0i64;
  v13 = 0;
  P = 0i64;
  if( !v2 || (v4 = *(_BYTE *)(a1 + 1), v4 >= 2u) || *(_WORD *)(a1 + 2) )
  {
    v9 = -1073741811;
    goto LABEL_13;
  }
  v5 = *(_DWORD *)(a1 + 4);
  if( (v4 & 1) != 0 )
  {
    v6 = v5 < 2;
  }
  else
  {
    if( (v5 & 4) != 0 && (v5 & 3) != 0 )
      return(unsigned int)-1073741811;
    v6 = v5 < 8;
  }
  if( !v6 )
    return(unsigned int)-1073741811;
  if( (int)PfSnCheckScenario(1, &v13) < 0 )
    return 0;
  v7 = (void *)*((_QWORD *)KeGetCurrentThread() + 23);
  v8 = PfCalculateProcessHash((__int64)v7, (unsigned __int64)&P);
  v3 = P;
  v9 = v8;
  if( v8 >= 0 )
  {
    if( PfSnFindImageFileName((UNICODE_STRING *)P, NameNumCharsOut) )
    {
      RtlStringCbPrintfW(pszDest, 0x3Cui64, (WCHAR *)L"Op-%.17s-%08X");
      v10 = *(_DWORD *)(a1 + 4);
      v11 = v10 & 1;
      v2 = (*(_BYTE *)(a1 + 1) & 1) == 0;
      v17 = *(_DWORD *)(a1 + 8);
      if( v2 )
      {
        if( (v10 & 2) != 0 || v13 == 2 )
        {
          v11 |= 2u;
        }
        else if( (v10 & 4) != 0 )
        {
          v11 |= 4u;
        }
        PfSnBeginScenario(v7, (unsigned __int8 *)pszDest, 1, v11, 0i64);
      }
      else
      {
        PfSnEndProcessTrace((__int64)v7, (unsigned int)(v11 + 8), pszDest);
      }
      v9 = 0;
    }
    else
    {
      v9 = -1073741595;
    }
  }
LABEL_13:
  if( v3 )
    ExFreePoolWithTag(v3, 0);
  return v9;
}

Referenced by: