PfSnOperationProcess

__int64 __fastcall PfSnOperationProcess(__int64 a1){
  bool v2; 
  _UNICODE_STRING *v3; 
  unsigned __int8 v4; 
  unsigned int v5; 
  bool v6; 
  _EPROCESS *Process; 
  NTSTATUS v8; 
  unsigned int v9; 
  int v10; 
  int v11; 
  _PF_ENABLE_STATUS EnableStatus; 
  _UNICODE_STRING *FullImageName; 
  __int64 NameNumCharsOut[2]; 
  WCHAR pszDest[32]; 

  memset(pszDest, 0i64, sizeof(pszDest));
  v2 = *(_BYTE *)a1 == 1;
  v3 = 0i64;
  EnableStatus = PfSvDefaultDisabled;
  FullImageName = 0i64;
  if( !v2 || (v4 = *(_BYTE *)(a1 + 1), v4 >= 2u) || *(_WORD *)(a1 + 2) )
  {
    v9 = -1073741811;
    goto LABEL_13;
  }
  v5 = *(_DWORD *)(a1 + 4);
  if( (v4 & 1) != 0 )
  {
    v6 = v5 < 2;
  }
  else
  {
    if( (v5 & 4) != 0 && (v5 & 3) != 0 )
      return(unsigned int)-1073741811;
    v6 = v5 < 8;
  }
  if( !v6 )
    return(unsigned int)-1073741811;
  if( PfSnCheckScenario(PfOperationScenarioType, &EnableStatus) < 0 )
    return 0;
  Process = KeGetCurrentThread()->ApcState.Process;
  v8 = PfCalculateProcessHash(Process, &FullImageName);
  v3 = FullImageName;
  v9 = v8;
  if( v8 >= 0 )
  {
    if( PfSnFindImageFileName(FullImageName, (UINT64 *)NameNumCharsOut) )
    {
      RtlStringCbPrintfW(pszDest, 0x3Cui64, (WCHAR *)L"Op-%.17s-%08X");
      v10 = *(_DWORD *)(a1 + 4);
      v11 = v10 & 1;
      v2 = (*(_BYTE *)(a1 + 1) & 1) == 0;
      *(_DWORD *)&pszDest[30] = *(_DWORD *)(a1 + 8);
      if( v2 )
      {
        if( (v10 & 2) != 0 || EnableStatus == PfSvTraceOnly )
        {
          v11 |= 2u;
        }
        else if( (v10 & 4) != 0 )
        {
          v11 |= 4u;
        }
        PfSnBeginScenario(Process, pszDest, 1, v11, 0i64);
      }
      else
      {
        PfSnEndProcessTrace(Process, v11 + 8, pszDest);
      }
      v9 = 0;
    }
    else
    {
      v9 = -1073741595;
    }
  }
LABEL_13:
  if( v3 )
    ExFreePoolWithTag(v3, 0);
  return v9;
}

Referenced by: