EtwpTraceProcessRundown

NTSTATUS __stdcall EtwpTraceProcessRundown(
        PEPROCESS Process,
        UINT64 *LoggerId,
        UINT16 HookId,
        _ETW_RUNDOWN_CONTEXT *RundownContext){
  CHAR v8; 
  __int64 v10; 
  PVOID P; 
  _UNICODE_STRING CommandLine; 
  _ETW_OTHER_PROCESS_INFO OtherInfo; 
  _UNICODE_STRING UnicodeString; 
  __int128 v15[2]; 
  __int64 v16; 
  char PackageInfo[408]; 
  __int64 v18[18]; 

  *(_DWORD *)(&CommandLine.MaximumLength + 1) = 0;
  LODWORD(v10) = 0;
  P = 0i64;
  UnicodeString = 0i64;
  memset(PackageInfo, 0i64, sizeof(PackageInfo));
  v8 = *((_BYTE *)RundownContext + 65);
  OtherInfo = 0i64;
  v16 = 0i64;
  CommandLine.Buffer = (wchar_t *)*((_QWORD *)RundownContext + 2);
  CommandLine.MaximumLength = *((_WORD *)RundownContext + 12);
  memset(v15, 0, sizeof(v15));
  CommandLine.Length = 0;
  EtwpBuildProcessEvent(
    Process,
    HookId,
    v8,
    (__int64)v15,
    &OtherInfo,
    (__int64)v18,
    (__int64)&v10,
    (_ETW_PACKAGE_IDENTITY *)PackageInfo,
    (_STRING *)&UnicodeString,
    &CommandLine,
    (__int64)&P);
  EtwpLogKernelEvent(
    (__int64)v18,
    (_ETW_SILODRIVERSTATE *)LoggerId[135],
    *(_DWORD *)LoggerId,
    v10,
    HookId,
    5249029 - (HookId != 807));
  if( CommandLine.Buffer != (wchar_t *)*((_QWORD *)RundownContext + 2) )
    ExFreePoolWithTag(CommandLine.Buffer, 0);
  RtlFreeAnsiString(&UnicodeString);
  if( P )
    ExFreePoolWithTag(P, 0);
  return 0;
}

Referenced by: