EtwpProcessEnumCallback

INT64 __fastcall EtwpProcessEnumCallback(_EPROCESS *Process, VOID *Context){
  UINT64 *v2; 
  UINT8 v3; 
  INT64 *v5; 
  char v7; 
  char v8; 
  __int64 ProcessServerSilo; 
  _EPROCESS *v10; 
  char v11; 
  int v12; 
  int v13; 
  int v15; 
  int v16; 
  unsigned int v17; 
  unsigned int i; 
  __int64 v19; 
  unsigned int v20; 
  unsigned int j; 
  __int64 v22; 
  __int64 *ServerSiloGlobals; 
  __int64 v24; 
  _KAPC_STATE ApcState; 
  v2 = (UINT64 *)*((_QWORD *)Context + 4);
  v3 = *((_BYTE *)Context + 64);
  v5 = *(INT64 **)Context;
  memset(&ApcState, 0, sizeof(ApcState));
  v7 = 0;
  v8 = 0;
  ProcessServerSilo = PsGetProcessServerSilo((__int64)Process);
  if( v2[135] != EtwpHostSiloState )
  {
    ServerSiloGlobals = PsGetServerSiloGlobals(ProcessServerSilo);
    if( ServerSiloGlobals[108] != v24 )
      return 0i64;
  }
  *((_BYTE *)Context + 65) = 0;
  if( !(unsigned int)EtwpIsProcessZombie((PEPROCESS)Process) )
  {
    v11 = 1;
    if( Process == PsIdleProcess )
    {
      v8 = 1;
    }
    else
    {
      if( *((_EPROCESS **)KeGetCurrentThread() + 23) == Process )
      {
LABEL_7:
        *((_BYTE *)Context + 65) = v11;
        *((_BYTE *)Context + 67) = v8;
        if( v5 )
        {
          if( v3 )
          {
            v15 = *(_DWORD *)v5;
            if( (*(_DWORD *)v5 & 1) != 0 )
            {
              EtwpTraceProcessRundown(Process, v2, 0x303u, (INT64)Context);
              v15 = *(_DWORD *)v5;
            }
            if( (v15 & 2) != 0 )
            {
              if( Process == PsIdleProcess )
              {
                v17 = KeNumberProcessors_0;
                for( i = 0; i < v17; ++i )
                {
                  KeGetPrcb(i);
                  EtwpThreadEnumCallback(Process, *(_ETHREAD **)(v19 + 24), Context);
                }
              }
              else
              {
                PsEnumProcessThreads(
                  (__int64)Process,
                  (__int64(__fastcall *)(__int64, _QWORD *, __int64))EtwpThreadEnumCallback,
                  (__int64)Context);
              }
            }
            v16 = *(_DWORD *)v5;
            if( (*(_DWORD *)v5 & 0xC004) != 0 )
            {
              EtwpEnumerateAddressSpace((INT64)Process, (INT64)Context, v5);
              v16 = *(_DWORD *)v5;
            }
            if( (v16 & 4) != 0 && Process == (_EPROCESS *)PsInitialSystemProcess )
              EtwpSysModuleRunDown((UINT64)v2, v3);
            if( (*((_DWORD *)v5 + 1) & 0x8000000) != 0 )
              EtwpEnumerateWorkingSet((__int64)Process, (__int64)Context);
          }
          else
          {
            if( (*((_DWORD *)v5 + 1) & 0x8000000) != 0 )
              EtwpEnumerateWorkingSet((__int64)Process, (__int64)Context);
            v12 = *(_DWORD *)v5;
            if( (*(_DWORD *)v5 & 4) != 0 && Process == (_EPROCESS *)PsInitialSystemProcess )
            {
              EtwpSysModuleRunDown((UINT64)v2, 0);
              v12 = *(_DWORD *)v5;
            }
            if( (v12 & 0xC004) != 0 )
              EtwpEnumerateAddressSpace((INT64)Process, (INT64)Context, v5);
            if( (v5[2] & 0x40) != 0 && Process != PsIdleProcess )
              EtwpObjectHandleRundown(Process, (__int64)Context);
            if( (*(_DWORD *)v5 & 2) != 0 )
            {
              if( Process == PsIdleProcess )
              {
                v20 = KeNumberProcessors_0;
                for( j = 0; j < v20; ++j )
                {
                  KeGetPrcb(j);
                  EtwpThreadEnumCallback(Process, *(_ETHREAD **)(v22 + 24), Context);
                }
              }
              else
              {
                PsEnumProcessThreads(
                  (__int64)Process,
                  (__int64(__fastcall *)(__int64, _QWORD *, __int64))EtwpThreadEnumCallback,
                  (__int64)Context);
              }
            }
            v13 = *(_DWORD *)v5;
            if( (*(_DWORD *)v5 & 8) != 0 )
            {
              EtwpProcessPerfCtrsRundown(Process, (UINT64)v2);
              v13 = *(_DWORD *)v5;
            }
            if( (v13 & 1) != 0 )
              EtwpTraceProcessRundown(Process, v2, 0x304u, (INT64)Context);
          }
        }
        if( v7 )
        {
          KiUnstackDetachProcess(&ApcState, 0i64);
          ExReleaseRundownProtection((PEX_RUNDOWN_REF)Process + 139);
        }
        return 0i64;
      }
      if( ExAcquireRundownProtection((PEX_RUNDOWN_REF)Process + 139) )
      {
        KiStackAttachProcess((_KPROCESS *)Process, 0i64, &ApcState);
        v7 = 1;
        goto LABEL_7;
      }
    }
    v11 = 0;
    goto LABEL_7;
  }
  if( v5 && (*(_DWORD *)v5 & 1) != 0 && !v3 )
    EtwpTraceProcessRundown(v10, v2, 0x327u, (INT64)Context);
  return 0i64;
}

Referenced by: