PfSnAppLaunchScenarioControl
INT64 __fastcall PfSnAppLaunchScenarioControl(INT64 a1, KPROCESSOR_MODE a2){
int v2;
bool v3;
NTSTATUS v4;
_DWORD *v5;
PVOID Object;
struct _KAPC_STATE ApcState;
Object = 0i64;
v2 = 0;
v3 = *(_DWORD *)a1 == 1;
memset(&ApcState, 0, sizeof(ApcState));
if( v3 )
{
if( *(_DWORD *)(a1 + 4) )
{
v4 = ObReferenceObjectByHandleWithTag(
*(HANDLE *)(a1 + 8),
8u,
(POBJECT_TYPE)PsProcessType,
a2,
0x73576650u,
&Object,
0i64);
if( v4 < 0 )
{
v5 = Object;
}
else
{
v5 = Object;
if( *((PVOID *)KeGetCurrentThread() + 23) != Object )
{
v2 = 1;
KeStackAttachProcess((PRKPROCESS)Object, &ApcState);
}
PfSnBeginAppLaunch(v5, 0i64, 9);
v4 = 0;
if( v2 )
KeUnstackDetachProcess(&ApcState);
}
if( v5 )
ObfDereferenceObjectWithTag(v5, 0x73576650ui64);
}
else
{
return(unsigned int)-1073741811;
}
}
else
{
return(unsigned int)-1073741735;
}
return(unsigned int)v4;
}Referenced by:
PfSnSetPrefetcherInformation