PsSetProcessTelemetryAppState

UINT64 __stdcall PsSetProcessTelemetryAppState(_EPROCESS *Process, _PS_TELEMETRY_APP_STATE NewState){
  _ETHREAD *CurrentThread; 
  _EX_PUSH_LOCK *p_ProcessLock; 
  unsigned int v6; 
  unsigned __int64 v7; 
  unsigned __int64 bf_920; 
  _PS_DEEP_FREEZE_STATS DeepFreezeStats; 
  _PS_TELEMETRY_APP_STATE_UPDATE_INFO UpdateInfo; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  p_ProcessLock = &Process->ProcessLock;
  memset(&DeepFreezeStats, 0, sizeof(DeepFreezeStats));
  memset(&UpdateInfo, 0, sizeof(UpdateInfo));
  while( 1 )
  {
    PsGetProcessDeepFreezeStats(Process, &DeepFreezeStats);
    v6 = 0;
    v7 = DeepFreezeStats.CurrentUnbiasedTime
       - DeepFreezeStats.TotalFrozenUnbiasedTime
       - Process->CreateUnbiasedInterruptTime;
    --CurrentThread->Tcb.KernelApcDisable;
    ExAcquirePushLockExclusiveEx(p_ProcessLock, 0i64);
    bf_920 = Process->_bf_920;
    if( bf_920 >> 61 != 3 && Process->LastAppStateUpdateTime <= DeepFreezeStats.CurrentTime )
    {
      UpdateInfo.LastUpdateTime = Process->LastAppStateUpdateTime;
      UpdateInfo.LastAppState = bf_920 >> 61;
      UpdateInfo.LastUnbiasedUptime = bf_920 & 0x1FFFFFFFFFFFFFFFi64;
      if( NewState == PsTelemetryAppStateHeartbeat && bf_920 >> 61 == 1 )
        NewState = PsTelemetryAppStateHeartbeatSuspended;
      Process->LastAppStateUpdateTime = DeepFreezeStats.CurrentTime;
      Process->_bf_920 = v7 & 0x1FFFFFFFFFFFFFFFi64 | ((__int64)(int)NewState << 61);
      v6 = 1;
    }
    if( (_InterlockedExchangeAdd64(&p_ProcessLock->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(p_ProcessLock);
    KeAbPostRelease(p_ProcessLock);
    KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
    if( (unsigned __int64)Process->_bf_920 >> 61 == 3 )
      break;
    if( v6 )
      goto LABEL_10;
  }
  if( !v6 )
    return v6;
LABEL_10:
  UpdateInfo.CurrentTime = DeepFreezeStats.CurrentTime;
  UpdateInfo.CurrentUnbiasedTime = DeepFreezeStats.CurrentUnbiasedTime;
  UpdateInfo.TotalFrozenTime = DeepFreezeStats.TotalFrozenUnbiasedTime;
  UpdateInfo.NewUnbiasedUptime = v7;
  UpdateInfo.NewAppState = NewState;
  EtwTraceAppStateChange(Process, &UpdateInfo);
  return v6;
}

Referenced by: