ViCreateProcessCallbackInternal

VOID __stdcall ViCreateProcessCallbackInternal(VOID *ProcessId, UINT8 Create){
  _EPROCESS *v2; 
  _UNICODE_STRING *v3; 
  char v4; 
  _KIRQL v5; 
  _UNICODE_STRING BaseImageName; 
  _EPROCESS *Process; 
  _UNICODE_STRING *ImageName; 

  if( Create )
  {
    Process = 0i64;
    ImageName = 0i64;
    BaseImageName = 0i64;
    if( PsLookupProcessByProcessId(ProcessId, &Process) >= 0 )
    {
      v2 = Process;
      if( PsGetAllocatedFullProcessImageName(Process, &ImageName) >= 0 )
      {
        v3 = ImageName;
        ViFaultsGetBaseImageName(ImageName, &BaseImageName);
        RtlUpcaseUnicodeString(&BaseImageName, &BaseImageName, 0);
        v4 = KeAcquireSpinLockRaiseToDpc(&ViFaultInjectionLock);
        if( (unsigned int)ViFaultsIsAppTarget(&BaseImageName) )
        {
          _InterlockedOr((volatile signed __int32 *)&v2->1120, 0x10000u);
          v2 = Process;
          v3 = ImageName;
        }
        LOBYTE(v5) = v4;
        KeReleaseSpinLock(&ViFaultInjectionLock, v5);
        ExFreePoolWithTag(v3, 0);
      }
      ObfDereferenceObjectWithTag(v2, 0x746C6644ui64);
    }
  }
}

Referenced by: