PfpLogApplicationEvent

NTSTATUS __stdcall PfpLogApplicationEvent(_EPROCESS *Process, _UNICODE_STRING *Filename, UINT8 Terminated){
  int UniqueProcessId; 
  NTSTATUS v5; 
  _LARGE_INTEGER CreateTime; 
  unsigned int v7; 
  __int64 v8; 
  unsigned __int16 *v9; 
  __int64 v10; 
  __int64 v11; 
  size_t v12; 
  NTSTATUS SessionId; 
  __int64 v14; 
  size_t v15; 
  int v16; 
  __int64 v18; 
  unsigned int ImagePathHash; 
  _EPROCESS *v20; 
  __int64 v21; 
  __int64 v22; 
  unsigned int v23; 
  int v24; 
  __int64 v25; 
  __int64 v26; 
  _EPROCESS *v27; 
  int v28; 
  unsigned __int16 v29; 
  __int16 v30[989]; 
  __int64 v31; 

  if( *(&stru_140C4DB30 + 2042) >= *(&stru_140C4DB30 + 2043) )
    return -1073741637;
  UniqueProcessId = (int)Process->UniqueProcessId;
  v5 = 0;
  CreateTime = Process->CreateTime;
  v31 = 0i64;
  if( Terminated )
  {
    v18 = (__int64)Process->UniqueProcessId ^ CreateTime.QuadPart;
    LODWORD(v22) = UniqueProcessId;
    v20 = Process;
    ImagePathHash = Process->ImagePathHash;
    v21 = v18 & 0x1FFFFFFFFFFFFFFFi64;
    v16 = 14;
    HIDWORD(v22) = ImagePathHash;
    v15 = 24;
  }
  else
  {
    v24 = UniqueProcessId;
    HIDWORD(v20) = 0;
    v28 = 0;
    v30[0] = 0;
    v27 = Process;
    v7 = Process->ImagePathHash;
    v25 = ((__int64)Process->UniqueProcessId ^ CreateTime.QuadPart) & 0x1FFFFFFFFFFFFFFFi64;
    v23 = v7;
    LODWORD(v8) = MmGetDirectoryFrameFromProcess(Process);
    v10 = *v9;
    v11 = *((_QWORD *)v9 + 1);
    v12 = v10;
    v26 = v8;
    if( (unsigned int)v10 > 0x7C0 )
      v12 = 1984;
    v29 = v12 >> 1;
    memmove(v30, (const VOID *)(v10 + v11 - v12), v12);
    v30[v29] = 0;
    SessionId = MmGetSessionIdEx(Process);
    if( SessionId != -1 )
      v5 = SessionId;
    LODWORD(v20) = v5;
    LODWORD(v14) = MmGetSessionGlobalVA(Process);
    v21 = v14;
    v15 = v12 + 64;
    v16 = 1;
    v22 = *(_QWORD *)&PsIdleProcess;
  }
  return PfLogEvent(
           v16,
           dword_140C5001C
         + (unsigned int)((((KUSER_SHARED_DATA.TickCountMultiplier
                           * (unsigned __int64)KUSER_SHARED_DATA.ReservedTickCountOverlay[1]) << 8)
                         + ((KUSER_SHARED_DATA.TickCountMultiplier
                           * (unsigned __int64)KUSER_SHARED_DATA.TickCount.LowPart) >> 24)) >> 10),
           &v20,
           v15);
}

Referenced by: