EtwQueryProcessTelemetryInfo

NTSTATUS __fastcall EtwQueryProcessTelemetryInfo(_EPROCESS *Process, VOID *Address, UINT64 Length, CHAR a4, INT64 a5){
  INT64 v5; 
  int v8; 
  _OBJECT_NAME_INFORMATION *ImageFileName; 
  VOID *v10; 
  int v11; 
  unsigned int v12; 
  size_t v13; 
  _EPROCESS *v14; 
  __int64 v15; 
  __int64 v16; 
  char *v17; 
  _OBJECT_NAME_INFORMATION *v18; 
  char *v19; 
  char *v20; 
  char *v21; 
  UINT64 RequiredLength; 
  char ProcessInfoFlags[12]; 
  _UNICODE_STRING CommandLine; 
  _DWORD *v27; 
  _OBJECT_NAME_INFORMATION *v28; 
  VOID *v29; 
  _EPROCESS *v30; 
  char PackageInfo[408]; 
  _KAPC_STATE ApcState; 
  char UserSid[80]; 

  v5 = (unsigned int)Length;
  v30 = Process;
  v27 = (_DWORD *)a5;
  memset(&ApcState, 0, sizeof(ApcState));
  memset(PackageInfo, 0i64, sizeof(PackageInfo));
  memset(UserSid, 0i64, 0x44u);
  LODWORD(RequiredLength) = 0;
  CommandLine = 0i64;
  v8 = 0;
  *(_QWORD *)&ProcessInfoFlags[4] = 0i64;
  ImageFileName = (_OBJECT_NAME_INFORMATION *)&EmptyUnicodeString;
  if( Process->SeAuditProcessCreationInfo.ImageFileName )
    ImageFileName = Process->SeAuditProcessCreationInfo.ImageFileName;
  v28 = ImageFileName;
  v10 = PsReferencePrimaryToken(Process);
  v29 = v10;
  *(_DWORD *)ProcessInfoFlags = 0;
  EtwpQueryTokenPackageInfo(v10, (_ETW_PACKAGE_IDENTITY *)PackageInfo, (UINT64 *)ProcessInfoFlags);
  v11 = SeQueryUserSidToken(v10, UserSid, 0x44ui64, &RequiredLength);
  if( v11 >= 0 )
  {
    if( PsAcquireProcessExitSynchronization(Process) >= 0 )
    {
      KiStackAttachProcess(Process, 0i64, &ApcState);
      EtwpQueryProcessOtherInfo(Process, (_ETW_OTHER_PROCESS_INFO *)&ProcessInfoFlags[4]);
      EtwpQueryProcessCommandLine(Process, &CommandLine);
      KiUnstackDetachProcess(&ApcState, 0i64);
      ExReleaseRundownProtection(&Process->RundownProtect);
      v8 = *(_DWORD *)&ProcessInfoFlags[4];
    }
    v12 = RequiredLength
        + 100
        + *(_DWORD *)PackageInfo
        + *(_DWORD *)&PackageInfo[8]
        + *(_WORD *)ImageFileName
        + CommandLine.Length;
    v13 = v12;
    if( v27 )
      *v27 = v12;
    if( a4 )
      ProbeForWrite((UINT64)Address, v5, 4i64);
    if( v12 >= (unsigned int)v5 )
      v13 = v5;
    memset(Address, 0i64, v13);
    if( (unsigned int)v5 < 0x60 )
    {
      v11 = -1073741820;
      HIDWORD(RequiredLength) = -1073741820;
    }
    else
    {
      *(_DWORD *)Address = 96;
      *((_DWORD *)Address + 1) = Process->UniqueProcessId;
      *((_QWORD *)Address + 1) = PsGetProcessStartKey((INT64)Process);
      *((_QWORD *)Address + 2) = Process->CreateTime.QuadPart;
      *((_QWORD *)Address + 3) = Process->CreateInterruptTime;
      *((_QWORD *)Address + 4) = Process->CreateUnbiasedInterruptTime;
      *((_QWORD *)Address + 5) = Process->SequenceNumber;
      LODWORD(v15) = MmGetSessionCreateTime(v14);
      *((_QWORD *)Address + 6) = v15;
      *((_DWORD *)Address + 14) = PsGetProcessSessionId((INT64)Process);
      *((_DWORD *)Address + 15) = KUSER_SHARED_DATA.BootId;
      *((_DWORD *)Address + 16) = v8;
      *((_DWORD *)Address + 17) = *(_DWORD *)&ProcessInfoFlags[8];
      if( (unsigned int)v5 >= v12 )
      {
        *((_DWORD *)Address + 18) = 96;
        v16 = (unsigned int)RequiredLength;
        memmove((char *)Address + 96, UserSid, RequiredLength);
        v17 = (char *)Address + v16 + 96;
        *((_DWORD *)Address + 19) = v16 + 96;
        v18 = v28;
        memmove(v17, *((const VOID **)v28 + 1), *(_WORD *)v28);
        v19 = &v17[*(_WORD *)v18 + 2];
        *((_DWORD *)Address + 20) = (_DWORD)v19 - (_DWORD)Address;
        memmove(v19, &PackageInfo[16], *(size_t *)PackageInfo);
        v20 = &v19[*(_QWORD *)PackageInfo];
        *((_DWORD *)Address + 21) = (_DWORD)v20 - (_DWORD)Address;
        memmove(v20, &PackageInfo[272], *(size_t *)&PackageInfo[8]);
        v21 = &v20[*(_QWORD *)&PackageInfo[8]];
        *((_DWORD *)Address + 22) = (_DWORD)v21 - (_DWORD)Address;
        memmove(v21, CommandLine.Buffer, CommandLine.Length);
        v11 = 0;
      }
      else
      {
        v11 = -2147483643;
        HIDWORD(RequiredLength) = -2147483643;
      }
    }
  }
  if( CommandLine.Buffer )
    ExFreePoolWithTag(CommandLine.Buffer, 0);
  if( v10 )
    ObFastDereferenceObject(&Process->Token, v10);
  return v11;
}

Referenced by: