PfSnEndProcessTrace
__int64 __fastcall PfSnEndProcessTrace(__int64 a1, UINT64 a2, const void *a3){
signed __int32 v4;
struct _EX_RUNDOWN_REF *v5;
unsigned int v6;
struct _EX_RUNDOWN_REF *v7;
v4 = a2;
v5 = PfSnReferenceProcessTrace(a1, a2);
v6 = 0;
v7 = v5;
if( v5 )
{
if( !a3 || !memcmp((PVOID)a3, &v5[3], 0x40ui64) )
{
if( _InterlockedCompareExchange((volatile signed __int32 *)&v7[50], v4, 0) )
v6 = -1073741431;
else
ExQueueWorkItem((WORK_QUEUE_ITEM *)&v7[46], DelayedWorkQueue);
}
else
{
v6 = -1073741198;
}
ExReleaseRundownProtection(v7 + 45);
}
else
{
return(unsigned int)-1073741275;
}
return v6;
}Referenced by:
PfSnFailProcessTrace
PfSnOperationProcess
PspExitProcess