PsSetProcessFaultInformation

NTSTATUS __stdcall PsSetProcessFaultInformation(ULONG_PTR Process, PROCESS_FAULT_INFORMATION *FaultInformation){
  _EPROCESS *v3; 
  PROCESS_FAULT_INFORMATION v4; 
  _EX_PUSH_LOCK *p_ProcessLock; 
  _ETHREAD *v6; 
  void(__fastcall **ExtensionTable)(_EPROCESS *, struct _KTHREAD *, PROCESS_FAULT_INFORMATION *); 
  signed __int32 v9; 
  signed __int32 v10; 
  _ETHREAD *CurrentThread; 
  _ETHREAD *v12; 
  int v13; 
  int v14; 

  v3 = *(_EPROCESS **)&Process;
  if( (*FaultInformation & 1) != 0 )
  {
    _m_prefetchw((const void *)(*(_QWORD *)&Process + 2172i64));
    v9 = *(_DWORD *)(*(_QWORD *)&Process + 2172i64);
    do
    {
      v10 = v9;
      v9 = _InterlockedCompareExchange((volatile signed __int32 *)(*(_QWORD *)&Process + 2172i64), v9 | 4, v9);
    }
    while( v10 != v9 );
    if( (v9 & 4) == 0 )
    {
      if( dword_140C0EE84 < KUSER_SHARED_DATA.TelemetryCoverageRound )
      {
        if( !dword_140C0EE80 )
          dword_140C0EE80 = TelemetryCoverageStringHashInternal((_BYTE *)off_140C0EE78, &v13);
        EtwTelemetryCoverageReport((INT64)&off_140C0EE78);
      }
      PspRecordCrashedProcessIntoBlackbox((INT64)v3);
      PsSetProcessTelemetryAppState(v3, PsTelemetryAppStateCrash);
    }
  }
  v4 = *FaultInformation;
  if( (*FaultInformation & 2) != 0 )
  {
    if( dword_140C0EE6C < KUSER_SHARED_DATA.TelemetryCoverageRound )
    {
      if( !dword_140C0EE68 )
        dword_140C0EE68 = TelemetryCoverageStringHashInternal((_BYTE *)off_140C0EE60, &v14);
      EtwTelemetryCoverageReport((INT64)&off_140C0EE60);
    }
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    p_ProcessLock = &v3->ProcessLock;
    ExAcquirePushLockExclusiveEx(&v3->ProcessLock, 0i64);
    if( (v3->_bf_87b & 7) != 7 )
      v3->_bf_87b ^= (v3->_bf_87b ^ (v3->_bf_87b + 1)) & 7;
    if( (_InterlockedExchangeAdd64(&p_ProcessLock->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(&v3->ProcessLock);
    KeAbPostRelease(&v3->ProcessLock);
    KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
    v4 = *FaultInformation;
  }
  else
  {
    p_ProcessLock = &v3->ProcessLock;
  }
  if( (v4 & 4) != 0 )
  {
    v6 = (_ETHREAD *)KeGetCurrentThread();
    --v6->Tcb.KernelApcDisable;
    ExAcquirePushLockExclusiveEx(p_ProcessLock, 0i64);
    if( (v3->_bf_87b & 0x38u) < 0x38 )
      v3->_bf_87b ^= (v3->_bf_87b ^ (v3->_bf_87b + 8)) & 0x38;
    if( (_InterlockedExchangeAdd64(&p_ProcessLock->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(p_ProcessLock);
    KeAbPostRelease(p_ProcessLock);
    KeLeaveCriticalRegionThread(&v6->Tcb);
    v4 = *FaultInformation;
  }
  if( (v4 & 8) != 0 )
  {
    v12 = (_ETHREAD *)KeGetCurrentThread();
    --v12->Tcb.KernelApcDisable;
    ExAcquirePushLockExclusiveEx(p_ProcessLock, 0i64);
    v3->_bf_87b |= 0x40u;
    if( (_InterlockedExchangeAdd64(&p_ProcessLock->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(p_ProcessLock);
    KeAbPostRelease(p_ProcessLock);
    KeLeaveCriticalRegionThread(&v12->Tcb);
  }
  ExtensionTable = (void(__fastcall **)(_EPROCESS *, struct _KTHREAD *, PROCESS_FAULT_INFORMATION *))ExGetExtensionTable((_EX_HOST *)PspHwTraceExtensionHost);
  if( ExtensionTable )
  {
    (*ExtensionTable)(v3, KeGetCurrentThread(), FaultInformation);
    ExReleaseExtensionTable(PspHwTraceExtensionHost);
  }
  return 0;
}

Referenced by: