PsSetProcessFaultInformation

INT64 __fastcall PsSetProcessFaultInformation(INT64 a1, INT64 *rdx0){
  int v4; 
  volatile signed __int64 *v5; 
  _ETHREAD *v6; 
  void(__fastcall **ExtensionTable)(INT64, struct _KTHREAD *, INT64 *); 
  signed __int32 v9; 
  signed __int32 v10; 
  _ETHREAD *CurrentThread; 
  _ETHREAD *v12; 
  int a2; 
  int v14; 
  if( (*(_DWORD *)rdx0 & 1) != 0 )
  {
    _m_prefetchw((const void *)(a1 + 2172));
    v9 = *(_DWORD *)(a1 + 2172);
    do
    {
      v10 = v9;
      v9 = _InterlockedCompareExchange((volatile signed __int32 *)(a1 + 2172), v9 | 4, v9);
    }
    while( v10 != v9 );
    if( (v9 & 4) == 0 )
    {
      if( dword_140C0EE84 < KUSER_SHARED_DATA.TelemetryCoverageRound )
      {
        if( !dword_140C0EE80 )
          dword_140C0EE80 = TelemetryCoverageStringHashInternal((_BYTE *)off_140C0EE78, &a2);
        EtwTelemetryCoverageReport((INT64)&off_140C0EE78);
      }
      PspRecordCrashedProcessIntoBlackbox(a1);
      PsSetProcessTelemetryAppState((_QWORD *)a1, 4);
    }
  }
  v4 = *(_DWORD *)rdx0;
  if( (*(_DWORD *)rdx0 & 2) != 0 )
  {
    if( dword_140C0EE6C < KUSER_SHARED_DATA.TelemetryCoverageRound )
    {
      if( !dword_140C0EE68 )
        dword_140C0EE68 = TelemetryCoverageStringHashInternal((_BYTE *)off_140C0EE60, &v14);
      EtwTelemetryCoverageReport((INT64)&off_140C0EE60);
    }
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 242);
    v5 = (volatile signed __int64 *)(a1 + 1080);
    ExAcquirePushLockExclusiveEx(a1 + 1080, 0i64);
    if( (*(_BYTE *)(a1 + 2171) & 7) != 7 )
      *(_BYTE *)(a1 + 2171) ^= (*(_BYTE *)(a1 + 2171) ^ (*(_BYTE *)(a1 + 2171) + 1)) & 7;
    if( (_InterlockedExchangeAdd64(v5, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((volatile INT64 *)(a1 + 1080));
    KeAbPostRelease((PVOID)(a1 + 1080));
    KeLeaveCriticalRegionThread((__int64)CurrentThread);
    v4 = *(_DWORD *)rdx0;
  }
  else
  {
    v5 = (volatile signed __int64 *)(a1 + 1080);
  }
  if( (v4 & 4) != 0 )
  {
    v6 = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)v6 + 242);
    ExAcquirePushLockExclusiveEx((UINT64)v5, 0i64);
    if( (*(_BYTE *)(a1 + 2171) & 0x38u) < 0x38 )
      *(_BYTE *)(a1 + 2171) ^= (*(_BYTE *)(a1 + 2171) ^ (*(_BYTE *)(a1 + 2171) + 8)) & 0x38;
    if( (_InterlockedExchangeAdd64(v5, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(v5);
    KeAbPostRelease((PVOID)v5);
    KeLeaveCriticalRegionThread((__int64)v6);
    v4 = *(_DWORD *)rdx0;
  }
  if( (v4 & 8) != 0 )
  {
    v12 = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)v12 + 242);
    ExAcquirePushLockExclusiveEx((UINT64)v5, 0i64);
    *(_BYTE *)(a1 + 2171) |= 0x40u;
    if( (_InterlockedExchangeAdd64(v5, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(v5);
    KeAbPostRelease((PVOID)v5);
    KeLeaveCriticalRegionThread((__int64)v12);
  }
  ExtensionTable = (void(__fastcall **)(INT64, struct _KTHREAD *, INT64 *))ExGetExtensionTable(PspHwTraceExtensionHost);
  if( ExtensionTable )
  {
    (*ExtensionTable)(a1, KeGetCurrentThread(), rdx0);
    ExReleaseExtensionTable(PspHwTraceExtensionHost);
  }
  return 0i64;
}

Referenced by: