EtwpQueryProcessCommandLine

NTSTATUS __stdcall EtwpQueryProcessCommandLine(_EPROCESS *Process, _UNICODE_STRING *CommandLine){
  wchar_t *Buffer; 
  _RTL_USER_PROCESS_PARAMETERS *ProcessParameters; 
  unsigned __int64 p_CommandLine; 
  unsigned __int16 v6; 
  unsigned __int64 v7; 
  unsigned __int16 MaximumLength; 
  VOID **PoolWithTag; 
  __int64 v10; 
  __int128 Src; 
  unsigned __int64 v14; 

  Src = 0i64;
  CommandLine->Length = 0;
  Buffer = CommandLine->Buffer;
  ProcessParameters = Process->Peb->ProcessParameters;
  if( ProcessParameters )
  {
    p_CommandLine = (unsigned __int64)&ProcessParameters->CommandLine;
    if( p_CommandLine >= 0x7FFFFFFF0000i64 )
      p_CommandLine = 0x7FFFFFFF0000i64;
    v14 = *(_QWORD *)(p_CommandLine + 8);
    *((_QWORD *)&Src + 1) = v14;
    v6 = *(_DWORD *)p_CommandLine & 0xFFFE;
    if( v6 )
    {
      if( v14 )
      {
        if( (v14 & 1) != 0 )
          ExRaiseDatatypeMisalignment();
        v7 = v14 + v6;
        if( v7 > 0x7FFFFFFF0000i64 || v7 < v14 )
          MEMORY[0x7FFFFFFF0000] = 0;
        if( v6 > 0x400u )
          v6 = 1024;
      }
      else
      {
        v6 = 0;
      }
    }
  }
  else
  {
    v6 = 0;
  }
  if( v6 )
  {
    MaximumLength = CommandLine->MaximumLength;
    if( MaximumLength )
    {
      if( v6 >= MaximumLength )
        v6 = CommandLine->MaximumLength;
    }
    else
    {
      PoolWithTag = ExAllocatePoolWithTag(1ui64, v6, 1350005829i64);
      Buffer = (wchar_t *)PoolWithTag;
      if( !PoolWithTag )
        return -1073741670;
      CommandLine->Buffer = (wchar_t *)PoolWithTag;
      CommandLine->MaximumLength = v6;
    }
    memmove(Buffer, *((const VOID **)&Src + 1), v6);
    if( v6 >> 1 )
    {
      v10 = v6 >> 1;
      do
      {
        if( !*Buffer )
          *Buffer = 32;
        ++Buffer;
        --v10;
      }
      while( v10 );
    }
    CommandLine->Length = v6;
  }
  return 0;
}

Referenced by: