EtwpQueryProcessCommandLine

INT64 __fastcall EtwpQueryProcessCommandLine(_EPROCESS *Process, _UNICODE_STRING *CommandLine){
  wchar_t *Buffer; 
  __int64 v4; 
  unsigned __int64 v5; 
  unsigned __int16 v6; 
  unsigned __int64 v7; 
  unsigned __int16 MaximumLength; 
  wchar_t *PoolWithTag; 
  __int64 v10; 
  __int128 Src; 
  unsigned __int64 v14; 
  Src = 0i64;
  CommandLine->Length = 0;
  Buffer = CommandLine->Buffer;
  v4 = *(_QWORD *)(*((_QWORD *)Process + 170) + 32i64);
  if( v4 )
  {
    v5 = v4 + 112;
    if( v5 >= 0x7FFFFFFF0000i64 )
      v5 = 0x7FFFFFFF0000i64;
    v14 = *(_QWORD *)(v5 + 8);
    *((_QWORD *)&Src + 1) = v14;
    v6 = *(_DWORD *)v5 & 0xFFFE;
    if( v6 )
    {
      if( v14 )
      {
        if( (v14 & 1) != 0 )
          ExRaiseDatatypeMisalignment();
        v7 = v14 + v6;
        if( v7 > 0x7FFFFFFF0000i64 || v7 < v14 )
          MEMORY[0x7FFFFFFF0000] = 0;
        if( v6 > 0x400u )
          v6 = 1024;
      }
      else
      {
        v6 = 0;
      }
    }
  }
  else
  {
    v6 = 0;
  }
  if( v6 )
  {
    MaximumLength = CommandLine->MaximumLength;
    if( MaximumLength )
    {
      if( v6 >= MaximumLength )
        v6 = CommandLine->MaximumLength;
    }
    else
    {
      PoolWithTag = (wchar_t *)ExAllocatePoolWithTag(PagedPool, v6, 0x50777445ui64);
      Buffer = PoolWithTag;
      if( !PoolWithTag )
        return(unsigned int)-1073741670;
      CommandLine->Buffer = PoolWithTag;
      CommandLine->MaximumLength = v6;
    }
    memmove((UINT8 *)Buffer, *((UINT8 **)&Src + 1), v6);
    if( v6 >> 1 )
    {
      v10 = v6 >> 1;
      do
      {
        if( !*Buffer )
          *Buffer = 32;
        ++Buffer;
        --v10;
      }
      while( v10 );
    }
    CommandLine->Length = v6;
  }
  return 0;
}

Referenced by: