EtwpGetPsmKeyExtendedHeaderItem

VOID __stdcall EtwpGetPsmKeyExtendedHeaderItem(_ETWP_HEADER_EXTENDED_DATA_ITEM *PsmKeyItem){
  _EPROCESS *Process; 
  __int64 v3; 
  VOID *v4; 
  NTSTATUS v5; 
  UINT64 v6; 
  int v7; 
  UINT8 SystemAppIdentifier; 
  UINT8 PackagedApplication; 
  UINT64 PsmKeySize; 

  SystemAppIdentifier = 0;
  PsmKeySize = 0i64;
  Process = KeGetCurrentThread()->ApcState.Process;
  v3 = 8i64;
  v4 = PsReferencePrimaryToken(Process);
  PsQueryProcessAttributesByToken(v4, &SystemAppIdentifier, &PackagedApplication);
  if( SystemAppIdentifier )
  {
    PsmKeySize = 466i64;
    v5 = EtwpQueryPsmKey(v4, (WCHAR *)&PsmKeyItem[1], &PsmKeySize);
    v6 = PsmKeySize;
    if( v5 < 0 )
      v6 = 0i64;
    v3 = v6 + 8;
  }
  else
  {
    LOWORD(v6) = PsmKeySize;
  }
  ObFastDereferenceObject(&Process->Token, v4);
  *(_DWORD *)&PsmKeyItem->ExtType = 9;
  PsmKeyItem->DataSize = v6;
  v7 = (v3 + 7) & 0xFFFFFFF8;
  PsmKeyItem->Size = v7;
  memset((char *)PsmKeyItem + v3, 0i64, v7 - v3);
}

Referenced by: