NTSTATUS __stdcall PfSnFailProcessTrace(INT64 a1){ if( (*(_BYTE *)(a1 + 484) & 2) == 0 ) _InterlockedOr16((volatile signed __int16 *)(a1 + 484), 2u); return PfSnEndProcessTrace(*(_EPROCESS **)(a1 + 352), 10, (const VOID *)(a1 + 24)); }