PopEtAggregateKeyCopyFromProcess

void __fastcall PopEtAggregateKeyCopyFromProcess(__int64 *a1, __int64 a2, __int64 a3){
  __int64 v3; 
  __int128 a2a; 
  __int64 v7; 
  __int64 v8; 
  v3 = *(_QWORD *)(a2 + 2280);
  v7 = 0i64;
  v8 = 0i64;
  a2a = *(_OWORD *)(v3 + 448);
  if( (*(_DWORD *)(a3 + 8) & 1) != 0 )
  {
    LODWORD(v8) = (unsigned int)PsGetProcessId((PEPROCESS)a2);
    v7 = *(_QWORD *)(a2 + 2296);
  }
  PopEtAggregateKeyCopy(a1, &a2a);
}

Referenced by: