EtwpPsProvTraceProcess

VOID __stdcall EtwpPsProvTraceProcess(
        PEPROCESS Process,
        UINT64 ProcessInfoFlags,
        _ETW_PACKAGE_IDENTITY *PackageInfo,
        _ETW_OTHER_PROCESS_INFO *OtherInfo,
        UINT16 HookId){
  char v6; 
  const _EVENT_DESCRIPTOR *v9; 
  ULONG v10; 
  void *InheritedFromUniqueProcessId; 
  int v12; 
  VOID *v13; 
  int v14; 
  _OBJECT_NAME_INFORMATION *p_DestinationString; 
  __int64 *v16; 
  unsigned int v17; 
  int v18; 
  VOID *v19; 
  int ReadOperationCount; 
  int WriteOperationCount; 
  __int64 v22; 
  int WriteTransferCount; 
  unsigned int *p_HardFaultCount; 
  unsigned __int8 *ImageFileName; 
  __int64 v26; 
  int v27; 
  int v28; 
  int ProcessHandleCount; 
  int v30; 
  int v31; 
  int v32; 
  int v33; 
  int v34; 
  NTSTATUS SessionId; 
  int v36; 
  __int64 v37; 
  volatile unsigned __int64 CommitCharge; 
  volatile unsigned __int64 CommitChargePeak; 
  __int64 v40; 
  PVOID v41; 
  PVOID v42; 
  _EPROCESS *Processa; 
  unsigned __int64 SequenceNumber; 
  VOID *TokenInformation; 
  PVOID P; 
  _SID_AND_ATTRIBUTES IntegritySA; 
  _UNICODE_STRING DestinationString; 
  _EPROCESS_VALUES Values; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  unsigned __int64 *p_SequenceNumber; 
  __int64 v52; 
  _LARGE_INTEGER *p_CreateTime; 
  __int64 v54; 
  _LARGE_INTEGER *p_ExitTime; 
  __int64 v56; 
  int *p_ExitStatus; 
  __int64 v58; 
  NTSTATUS *p_SessionId; 
  __int64 v60; 
  int *p_ProcessHandleCount; 
  __int64 v62; 
  volatile unsigned __int64 *p_CommitCharge; 
  __int64 v64; 
  volatile unsigned __int64 *p_CommitChargePeak; 
  __int64 v66; 
  void *p_CycleTime; 
  __int64 v68; 
  int *v69; 
  __int64 v70; 
  __int64 *v71; 
  __int64 v72; 
  _ETW_OTHER_PROCESS_INFO *v73; 
  __int64 v74; 
  unsigned int *p_TimeDateStamp; 
  __int64 v76; 
  wchar_t *v77; 
  __int64 PackageNameSize; 
  wchar_t *v79; 
  int v80; 
  int v81; 
  WCHAR pszDest[16]; 

  v6 = ProcessInfoFlags;
  v28 = 0;
  v34 = 0;
  SessionId = 0;
  v27 = 0;
  ProcessHandleCount = 0;
  CommitCharge = 0i64;
  CommitChargePeak = 0i64;
  memset(&Values, 0i64, sizeof(Values));
  v30 = 0;
  v31 = 0;
  v32 = 0;
  v33 = 0;
  DestinationString = 0i64;
  switch( HookId )
  {
    case 0x301u:
      v9 = &ProcessStart;
      goto LABEL_3;
    case 0x302u:
      v9 = (const _EVENT_DESCRIPTOR *)ProcessStop;
      goto LABEL_3;
    case 0x303u:
      v9 = (const _EVENT_DESCRIPTOR *)ProcessRundown;
LABEL_3:
      LODWORD(v40) = Process->UniqueProcessId;
      v10 = 3;
      *(_QWORD *)&UserData.Size = 4i64;
      UserData.Ptr = (unsigned __int64)&v40;
      p_SequenceNumber = &Process->SequenceNumber;
      p_CreateTime = &Process->CreateTime;
      v52 = 8i64;
      v54 = 8i64;
      if( ((HookId - 769) & 0xFFFD) != 0 )
      {
        if( HookId != 770 )
          goto LABEL_24;
        v41 = 0i64;
        PsQueryStatisticsProcess(Process, &Values);
        v56 = 8i64;
        p_ExitTime = &Process->ExitTime;
        v58 = 4i64;
        p_ExitStatus = &Process->ExitStatus;
        v19 = PsReferencePrimaryToken(Process);
        if( SeQueryInformationToken(v19, TokenElevationType, &v41) >= 0 )
        {
          if( *(_DWORD *)v41 == 1 )
          {
            v42 = 0i64;
            if( SeQueryInformationToken(v19, TokenElevation, &v42) >= 0 )
              v27 = *(_DWORD *)v42 != 0 ? 1 : 4;
            if( v42 )
              ExFreePoolWithTag(v42, 0);
          }
          else
          {
            v27 = *(_DWORD *)v41;
          }
        }
        ObFastDereferenceObject(&Process->Token, v19);
        if( v41 )
          ExFreePoolWithTag(v41, 0);
        v60 = 4i64;
        p_SessionId = &v27;
        ProcessHandleCount = ObGetProcessHandleCount((_EX_RUNDOWN_REF *)Process, 0i64);
        v62 = 4i64;
        p_ProcessHandleCount = &ProcessHandleCount;
        CommitCharge = Process->CommitCharge;
        CommitCharge <<= 12;
        p_CommitCharge = &CommitCharge;
        CommitChargePeak = Process->CommitChargePeak;
        CommitChargePeak <<= 12;
        p_CommitChargePeak = &CommitChargePeak;
        p_CycleTime = &Values.CycleTime;
        ReadOperationCount = Values.ReadOperationCount;
        if( HIDWORD(Values.ReadOperationCount) )
          ReadOperationCount = -1;
        v64 = 8i64;
        v30 = ReadOperationCount;
        v69 = &v30;
        WriteOperationCount = Values.WriteOperationCount;
        if( HIDWORD(Values.WriteOperationCount) )
          WriteOperationCount = -1;
        v66 = 8i64;
        v31 = WriteOperationCount;
        v22 = Values.ReadTransferCount >> 10;
        v71 = (__int64 *)&v31;
        Values.ReadTransferCount = v22;
        v68 = 8i64;
        if( HIDWORD(v22) )
          LODWORD(v22) = -1;
        v73 = (_ETW_OTHER_PROCESS_INFO *)&v32;
        v32 = v22;
        Values.WriteTransferCount >>= 10;
        WriteTransferCount = Values.WriteTransferCount;
        v70 = 4i64;
        v72 = 4i64;
        if( HIDWORD(Values.WriteTransferCount) )
          WriteTransferCount = -1;
        p_TimeDateStamp = (unsigned int *)&v33;
        p_HardFaultCount = &Process->Vm.Instance.HardFaultCount;
        v74 = 4i64;
        ImageFileName = Process->ImageFileName;
        v77 = (wchar_t *)p_HardFaultCount;
        v79 = (wchar_t *)ImageFileName;
        v26 = -1i64;
        v33 = WriteTransferCount;
        v76 = 4i64;
        PackageNameSize = 4i64;
        do
          ++v26;
        while( ImageFileName[v26] );
        v18 = v26 + 1;
      }
      else
      {
        InheritedFromUniqueProcessId = Process->InheritedFromUniqueProcessId;
        SequenceNumber = -1i64;
        v36 = -1;
        v34 = (int)Process->InheritedFromUniqueProcessId;
        LODWORD(v37) = -1;
        p_ExitTime = (_LARGE_INTEGER *)&v34;
        Processa = 0i64;
        TokenInformation = 0i64;
        P = 0i64;
        IntegritySA = 0i64;
        v56 = 4i64;
        if( PsLookupProcessByProcessId(InheritedFromUniqueProcessId, &Processa) >= 0 )
        {
          SequenceNumber = Processa->SequenceNumber;
          HalPutDmaAdapter((PADAPTER_OBJECT)Processa);
        }
        v58 = 8i64;
        p_ExitStatus = (int *)&SequenceNumber;
        SessionId = MmGetSessionId(Process);
        v12 = 1;
        v60 = 4i64;
        p_SessionId = &SessionId;
        if( (v6 & 1) == 0 )
        {
          v10 = 2;
          v12 = v28;
        }
        v62 = 4i64;
        if( (v6 & 8) != 0 )
          v12 = v10;
        p_ProcessHandleCount = &v28;
        v28 = v12;
        v13 = PsReferencePrimaryToken(Process);
        if( SeQueryInformationToken(v13, TokenElevationType, &TokenInformation) >= 0 )
          v36 = *(_DWORD *)TokenInformation;
        v64 = 4i64;
        p_CommitCharge = (volatile unsigned __int64 *)&v36;
        if( TokenInformation )
          ExFreePoolWithTag(TokenInformation, 0);
        if( SeQueryInformationToken(v13, TokenElevation, &P) >= 0 )
          LODWORD(v37) = *(_DWORD *)P;
        v66 = 4i64;
        p_CommitChargePeak = (volatile unsigned __int64 *)&v37;
        if( P )
          ExFreePoolWithTag(P, 0);
        SeQueryTokenIntegrity(v13, &IntegritySA);
        v14 = *((unsigned __int8 *)IntegritySA.Sid + 1);
        p_CycleTime = IntegritySA.Sid;
        v68 = (unsigned int)(4 * v14 + 8);
        ObFastDereferenceObject(&Process->Token, v13);
        p_DestinationString = Process->SeAuditProcessCreationInfo.ImageFileName;
        if( !p_DestinationString || !*(_WORD *)p_DestinationString )
        {
          RtlStringCchPrintfW(pszDest, 0xFui64, (WCHAR *)L"%S");
          RtlInitUnicodeString(&DestinationString, pszDest);
          p_DestinationString = (_OBJECT_NAME_INFORMATION *)&DestinationString;
        }
        v16 = &EmptyUnicodeString;
        if( p_DestinationString )
          v16 = (__int64 *)p_DestinationString;
        v17 = *(unsigned __int16 *)v16;
        v69 = (int *)v16[1];
        v71 = &EtwpNull;
        p_TimeDateStamp = &OtherInfo->TimeDateStamp;
        v77 = &PackageInfo->PackageName[4];
        PackageNameSize = PackageInfo->PackageNameSize;
        v79 = &PackageInfo->ApplicationName[4];
        v18 = *(_DWORD *)PackageInfo->PackageName;
        v70 = v17;
        v72 = 2i64;
        v73 = OtherInfo;
        v74 = 4i64;
        v76 = 4i64;
      }
      v10 = 16;
      v81 = 0;
      v80 = v18;
LABEL_24:
      EtwWrite(*(&ExBootDevicesRemovedEvent + 245), v9, 0, v10, &UserData);
      break;
  }
}

Referenced by: