EtwTraceAppStateChange

VOID __stdcall EtwTraceAppStateChange(_EPROCESS *Process, _PS_TELEMETRY_APP_STATE_UPDATE_INFO *UpdateInfo){
  unsigned __int64 v4; 
  unsigned __int64 NewUnbiasedUptime; 
  unsigned __int64 v6; 
  char NewAppState; 
  unsigned __int64 v8; 
  unsigned __int64 v9; 
  unsigned int v10; 
  unsigned int v11; 
  unsigned int ReadOperationCount; 
  unsigned int WriteOperationCount; 
  _ETW_APPSTATE_PROCESS_TERMINATE_METRICS *p_AggregateProcessTerminateMetrics; 
  char v15; 
  char v16; 
  VOID *v17; 
  UINT64 ProcessInfoFlags; 
  _ETW_OTHER_PROCESS_INFO OtherInfo; 
  _UNICODE_STRING CommandLine; 
  _EPROCESS_VALUES Values; 
  _ETW_APPSTATE_PROCESS_TERMINATE_METRICS AggregateProcessTerminateMetrics; 
  char StateChangeInfo[98]; 
  _KAPC_STATE ApcState; 
  char PackageInfo[408]; 

  memset(StateChangeInfo, 0i64, sizeof(StateChangeInfo));
  memset(&AggregateProcessTerminateMetrics, 0, sizeof(AggregateProcessTerminateMetrics));
  if( *(&stru_140C00F40 + 1806) && tlgKeywordOn((__int64)&stru_140C00F40 + 7224, 0x600000000001i64) )
  {
    EtwpInitStateChangeInfo(Process, (_ETW_APPSTATE_CHANGE_INFO *)StateChangeInfo);
    v4 = UpdateInfo->CurrentTime - UpdateInfo->LastUpdateTime;
    NewUnbiasedUptime = UpdateInfo->NewUnbiasedUptime;
    v6 = UpdateInfo->CurrentTime - Process->CreateInterruptTime;
    NewAppState = UpdateInfo->NewAppState;
    StateChangeInfo[1] = UpdateInfo->LastAppState;
    v8 = v4;
    StateChangeInfo[0] = NewAppState;
    v9 = NewUnbiasedUptime - UpdateInfo->LastUnbiasedUptime;
    *(_QWORD *)&StateChangeInfo[41] = v8 / 0x2710;
    *(_QWORD *)&StateChangeInfo[49] = v9 / 0x2710;
    *(_QWORD *)&StateChangeInfo[57] = v6 / 0x2710;
    *(_QWORD *)&StateChangeInfo[65] = NewUnbiasedUptime / 0x2710;
    *(_QWORD *)&StateChangeInfo[73] = UpdateInfo->TotalFrozenTime / 0x2710;
    if( NewAppState == 3 )
    {
      memset(&Values, 0i64, sizeof(Values));
      PsQueryStatisticsProcess(Process, &Values);
      AggregateProcessTerminateMetrics.HandleCount = ObGetProcessHandleCount((_EX_RUNDOWN_REF *)Process, 0i64);
      v10 = -1;
      v11 = -1;
      AggregateProcessTerminateMetrics.CommitCharge = Process->CommitCharge << 12;
      AggregateProcessTerminateMetrics.CommitChargePeak = Process->CommitChargePeak << 12;
      ReadOperationCount = -1;
      if( Values.ReadOperationCount < 0xFFFFFFFFi64 )
        ReadOperationCount = Values.ReadOperationCount;
      AggregateProcessTerminateMetrics.ReadCount = ReadOperationCount;
      WriteOperationCount = -1;
      if( Values.WriteOperationCount < 0xFFFFFFFFi64 )
        WriteOperationCount = Values.WriteOperationCount;
      AggregateProcessTerminateMetrics.WriteCount = WriteOperationCount;
      if( Values.ReadTransferCount / 1024 < 0xFFFFFFFFi64 )
        v11 = Values.ReadTransferCount / 1024;
      AggregateProcessTerminateMetrics.ReadSizeInKB = v11;
      if( Values.WriteTransferCount / 1024 < 0xFFFFFFFFi64 )
        v10 = Values.WriteTransferCount / 1024;
      AggregateProcessTerminateMetrics.WriteSizeInKB = v10;
      AggregateProcessTerminateMetrics.CycleCount = Values.CycleTime;
      EtwpWriteAppStateChangeWithStats(
        Process,
        (_ETW_APPSTATE_CHANGE_INFO *)StateChangeInfo,
        &AggregateProcessTerminateMetrics);
      p_AggregateProcessTerminateMetrics = &AggregateProcessTerminateMetrics;
    }
    else
    {
      EtwpWriteAppStateChange((_ETW_APPSTATE_CHANGE_INFO *)StateChangeInfo);
      p_AggregateProcessTerminateMetrics = 0i64;
    }
    if( *(&stru_140C00F40 + 1806) && tlgKeywordOn((__int64)&stru_140C00F40 + 7224, 0x400000000000i64) )
    {
      memset(PackageInfo, 0i64, sizeof(PackageInfo));
      OtherInfo = 0i64;
      LODWORD(ProcessInfoFlags) = 0;
      CommandLine = 0i64;
      v15 = 0;
      v16 = 1;
      memset(&ApcState, 0, sizeof(ApcState));
      if( KeGetCurrentThread()->ApcState.Process != Process )
      {
        if( ExAcquireRundownProtection(&Process->RundownProtect) )
        {
          KiStackAttachProcess(Process, 0i64, &ApcState);
          v15 = 1;
        }
        else
        {
          v16 = 0;
        }
      }
      v17 = PsReferencePrimaryToken(Process);
      EtwpQueryTokenPackageInfo(v17, (_ETW_PACKAGE_IDENTITY *)PackageInfo, &ProcessInfoFlags);
      ObFastDereferenceObject(&Process->Token, v17);
      if( v16 )
      {
        if( Process->Peb && EtwpAppStateChangeSummaryShouldLogCommandLine(Process) )
          EtwpQueryProcessCommandLine(Process, &CommandLine);
        EtwpQueryProcessOtherInfo(Process, &OtherInfo);
      }
      if( v15 )
      {
        KiUnstackDetachProcess(&ApcState, 0i64);
        ExReleaseRundownProtection(&Process->RundownProtect);
      }
      EtwpWriteAppStateChangeSummary(
        Process,
        (_ETW_APPSTATE_CHANGE_INFO *)StateChangeInfo,
        p_AggregateProcessTerminateMetrics,
        (_ETW_PACKAGE_IDENTITY *)PackageInfo,
        &OtherInfo,
        &CommandLine,
        (_ETW_PACKAGE_IDENTITY *)ProcessInfoFlags);
      if( CommandLine.Buffer )
        ExFreePoolWithTag(CommandLine.Buffer, 0);
    }
  }
}

Referenced by: