EtwpProcessThreadImageRundown

NTSTATUS __stdcall EtwpProcessThreadImageRundown(PERFINFO_GROUPMASK *GroupMasks, UINT64 LoggerId, UINT8 Start){
  unsigned int **v3; 
  int v7; 
  unsigned int **v8; 
  INT16 v9; 
  _EPROCESS *v10; 
  VOID *v11; 
  unsigned int v13; 
  _DWORD *v14; 
  INT64 Context[10]; 
  _EPROCESS *Process; 
  unsigned int v17; 

  Process = 0i64;
  v7 = 0;
  v8 = v3;
  memset(Context, 0i64, 0x48u);
  Context[0] = (INT64)GroupMasks;
  Context[4] = LoggerId;
  v9 = 1283;
  LOBYTE(Context[8]) = Start;
  if( !Start )
    v9 = 1284;
  BYTE2(Context[8]) = EtwpIsStackWalkingEnabled(LoggerId, v9);
  if( GroupMasks && (GroupMasks[4] & 0x40) != 0 && (*(_DWORD *)(LoggerId + 12) & 0x2000000) != 0 )
    Context[1] = (INT64)&ExBootDevicesRemovedEvent + 20 * *(unsigned __int8 *)(LoggerId + 834) + 1568;
  Context[2] = (INT64)ExAllocatePoolWithTag(0x200ui64, 0x2000ui64, 1953985605i64);
  if( Context[2] )
    LOWORD(Context[3]) = 0x2000;
  if( v17 && v8 )
  {
    v13 = 0;
    v14 = (_DWORD *)v8 + 3;
    while( *v14 != -2147483644 )
    {
      ++v13;
      v14 += 4;
      if( v13 >= v17 )
        goto LABEL_8;
    }
    v7 = PsLookupProcessByProcessId((VOID *)**v8, &Process);
    if( v7 >= 0 )
      EtwpProcessEnumCallback((ULONG_PTR)Process, Context);
  }
  else
  {
LABEL_8:
    EtwpProcessEnumCallback(PsIdleProcess, Context);
    PsEnumProcesses((INT64)EtwpProcessEnumCallback, Context, v10, v11, (VOID *)Context[0]);
  }
  if( Context[2] )
    ExFreePoolWithTag((PVOID)Context[2], 0);
  if( Context[6] )
    ExFreePoolWithTag((PVOID)Context[6], 0);
  return v7;
}

Referenced by: