PopEtGetProcessImageInfo

NTSTATUS __stdcall PopEtGetProcessImageInfo(INT64 a1, INT64 a2){
  VOID *ProcessSectionBaseAddress; 
  __int64 v4; 

  *(_QWORD *)a2 = 0i64;
  if( (*(_DWORD *)(a1 + 2172) & 1) == 0 )
  {
    ProcessSectionBaseAddress = PsGetProcessSectionBaseAddress((_EPROCESS *)a1);
    if( ProcessSectionBaseAddress )
    {
      LODWORD(v4) = RtlImageNtHeader((UINT64)ProcessSectionBaseAddress);
      if( v4 )
      {
        *(_DWORD *)a2 = *(_DWORD *)(v4 + 88);
        *(_DWORD *)(a2 + 4) = *(_DWORD *)(v4 + 8);
      }
    }
  }
  return 0;
}

Referenced by: