PopEtAggregateKeyCopyFromProcess

VOID __stdcall PopEtAggregateKeyCopyFromProcess(INT64 *a1, _EPROCESS *rdx0, INT64 a3){
  struct _PO_PROCESS_ENERGY_CONTEXT *EnergyContext; 
  __int128 v6; 
  unsigned __int64 SequenceNumber; 
  __int64 v8; 

  EnergyContext = rdx0->EnergyContext;
  SequenceNumber = 0i64;
  v8 = 0i64;
  v6 = *((_OWORD *)EnergyContext + 28);
  if( (*(_DWORD *)(a3 + 8) & 1) != 0 )
  {
    LODWORD(v8) = (unsigned int)PsGetProcessId(rdx0);
    SequenceNumber = rdx0->SequenceNumber;
  }
  PopEtAggregateKeyCopy(a1, &v6);
}

Referenced by: