EtwpProcessThreadImageRundown

INT64 __fastcall EtwpProcessThreadImageRundown(_PERFINFO_GROUPMASK *GroupMasks, UINT64 LoggerId, UINT8 Start){
  unsigned int **v3; 
  NTSTATUS v7; 
  unsigned int **v8; 
  INT16 v9; 
  unsigned int v11; 
  _DWORD *v12; 
  INT64 result[2]; 
  PVOID P; 
  __int16 v15; 
  UINT64 v16; 
  PVOID v17; 
  UINT8 v18; 
  UINT8 IsStackWalkingEnabled; 
  _EPROCESS *Process; 
  unsigned int v21; 
  Process = 0i64;
  v7 = 0;
  v8 = v3;
  memset((INT64)result, 0i64);
  result[0] = (INT64)GroupMasks;
  v16 = LoggerId;
  v9 = 1283;
  v18 = Start;
  if( !Start )
    v9 = 1284;
  IsStackWalkingEnabled = EtwpIsStackWalkingEnabled(LoggerId, v9);
  if( GroupMasks && (GroupMasks->Masks[4] & 0x40) != 0 && (*(_DWORD *)(LoggerId + 12) & 0x2000000) != 0 )
    result[1] = (INT64)EtwpObjectTypeFilter + 20 * *(unsigned __int8 *)(LoggerId + 834);
  P = ExAllocatePoolWithTag(NonPagedPoolNx, 0x2000ui64, 0x74777445ui64);
  if( P )
    v15 = 0x2000;
  if( v21 && v8 )
  {
    v11 = 0;
    v12 = (_DWORD *)v8 + 3;
    while( *v12 != -2147483644 )
    {
      ++v11;
      v12 += 4;
      if( v11 >= v21 )
        goto LABEL_8;
    }
    v7 = PsLookupProcessByProcessId((HANDLE)**v8, (PEPROCESS *)&Process);
    if( v7 >= 0 )
      EtwpProcessEnumCallback(Process, result);
  }
  else
  {
LABEL_8:
    EtwpProcessEnumCallback((_EPROCESS *)PsIdleProcess, result);
    PsEnumProcesses((__int64(__fastcall *)(unsigned __int64, __int64))EtwpProcessEnumCallback, (__int64)result);
  }
  if( P )
    ExFreePoolWithTag(P, 0);
  if( v17 )
    ExFreePoolWithTag(v17, 0);
  return(unsigned int)v7;
}

Referenced by: