PfCalculateProcessHash

NTSTATUS __stdcall PfCalculateProcessHash(_EPROCESS *Process, _UNICODE_STRING **FullImageName){
  _QWORD *v2; 
  int v4; 
  NTSTATUS AllocatedFullProcessImageName; 
  _UNICODE_STRING *v6; 
  int v7; 
  __int64 Length; 
  __int64 v9; 
  unsigned __int8 *Buffer; 
  unsigned __int64 v11; 
  __int64 v12; 
  __int64 v13; 
  int v15; 
  int v16; 
  int v17; 
  int v18; 
  int v19; 
  int v20; 
  _UNICODE_STRING *DestinationString; 

  v2 = (_QWORD *)((unsigned __int64)FullImageName & 0xFFFFFFFFFFFFFFFEui64);
  DestinationString = 0i64;
  v4 = (unsigned __int8)FullImageName & 1;
  if( ((unsigned __int8)FullImageName & 1) == 0 )
    v2 = FullImageName;
  if( !Process->SectionObject )
  {
    v7 = -1073741275;
    return v2 != 0i64 ? v7 : 0;
  }
  AllocatedFullProcessImageName = PsGetAllocatedFullProcessImageName(Process, &DestinationString);
  v6 = DestinationString;
  v7 = AllocatedFullProcessImageName;
  if( AllocatedFullProcessImageName >= 0 )
  {
    if( DestinationString->Length )
    {
      RtlUpcaseUnicodeString(DestinationString, DestinationString, 0);
      if( Process->ImagePathHash )
      {
LABEL_18:
        if( v4 )
          PfpLogApplicationEvent(Process, v6, 0);
        if( v2 )
        {
          *v2 = v6;
          v6 = 0i64;
        }
        v7 = 0;
        goto LABEL_23;
      }
      Length = v6->Length;
      v9 = 314159i64;
      Buffer = (unsigned __int8 *)v6->Buffer;
      if( (unsigned __int64)Length >= 8 )
      {
        v11 = (unsigned __int64)v6->Length >> 3;
        Length = v6->Length - 8 * v11;
        do
        {
          v12 = Buffer[7];
          v13 = 37
              * (Buffer[6]
               + 37
               * (Buffer[5]
                + 37 * (Buffer[4] + 37 * (Buffer[3] + 37 * (Buffer[2] + 37 * (Buffer[1] + 37 * (*Buffer + 37 * v9)))))));
          Buffer += 8;
          v9 = v12 + v13;
          --v11;
        }
        while( v11 );
      }
      if( Length >= 1 && Length <= 7 )
      {
        v15 = Length - 1;
        if( v15 )
        {
          v16 = v15 - 1;
          if( v16 )
          {
            v17 = v16 - 1;
            if( v17 )
            {
              v18 = v17 - 1;
              if( v18 )
              {
                v19 = v18 - 1;
                if( v19 )
                {
                  v20 = v19 - 1;
                  if( v20 )
                  {
                    if( v20 != 1 )
                      goto LABEL_15;
                    LODWORD(v9) = *Buffer++ + 37 * v9;
                  }
                  LODWORD(v9) = *Buffer++ + 37 * v9;
                }
                LODWORD(v9) = *Buffer++ + 37 * v9;
              }
              LODWORD(v9) = *Buffer++ + 37 * v9;
            }
            LODWORD(v9) = *Buffer++ + 37 * v9;
          }
          LODWORD(v9) = *Buffer++ + 37 * v9;
        }
        LODWORD(v9) = *Buffer + 37 * v9;
      }
LABEL_15:
      if( (unsigned int)v9 <= 1 )
        LODWORD(v9) = 1;
      Process->ImagePathHash = v9;
      goto LABEL_18;
    }
    v7 = -1073741198;
  }
LABEL_23:
  if( v6 )
    ExFreePoolWithTag(v6, 0);
  return v2 != 0i64 ? v7 : 0;
}

Referenced by: