PfProcessCreateNotification

NTSTATUS __stdcall PfProcessCreateNotification(_EPROCESS *Process, VOID *SectionObject){
  UINT64 ImagePathHash; 
  _UNICODE_STRING *ImageName; 

  if( !SectionObject )
    return -1073741637;
  ImageName = 0i64;
  if( (*(&stru_140C4DB30 + 7640) & 1) != 0 || (dword_140C50130[0] & 1) != 0 )
  {
    PfCalculateProcessHash(Process, (_UNICODE_STRING **)((char *)&ImageName + 1));
    if( (dword_140C50130[0] & 1) != 0 )
    {
      ImagePathHash = Process->ImagePathHash;
      if( (_DWORD)ImagePathHash )
      {
        if( (unsigned int)PfCheckDeprioritizeImage(ImagePathHash) )
          _InterlockedOr((volatile signed __int32 *)&Process->1124, 0x4000u);
      }
    }
  }
  PfSnBeginAppLaunch(Process, ImageName, 0i64);
  if( ImageName )
    ExFreePoolWithTag(ImageName, 0);
  return 0;
}

Referenced by: