ViCreateProcessCallbackInternal

VOID __fastcall ViCreateProcessCallbackInternal(VOID *ProcessId, UINT8 Create){
  _EPROCESS *v2; 
  PVOID v3; 
  UINT64 v4; 
  UINT8 v5; 
  UINT8 v6; 
  UNICODE_STRING SourceString; 
  _EPROCESS *Process; 
  PVOID P; 
  if( Create )
  {
    Process = 0i64;
    P = 0i64;
    SourceString = 0i64;
    if( PsLookupProcessByProcessId(ProcessId, (PEPROCESS *)&Process) >= 0 )
    {
      v2 = Process;
      if( (int)PsGetAllocatedFullProcessImageName((__int64)Process, &P) >= 0 )
      {
        v3 = P;
        ViFaultsGetBaseImageName((UNICODE_STRING *)P, &SourceString);
        RtlUpcaseUnicodeString(&SourceString, &SourceString, 0);
        KeAcquireSpinLockRaiseToDpc(&ViFaultInjectionLock, v4);
        v6 = v5;
        if( (unsigned int)ViFaultsIsAppTarget(&SourceString) )
        {
          _InterlockedOr((volatile signed __int32 *)v2 + 280, 0x10000u);
          v2 = Process;
          v3 = P;
        }
        KeReleaseSpinLock(&ViFaultInjectionLock, v6);
        ExFreePoolWithTag(v3, 0);
      }
      ObfDereferenceObjectWithTag(v2, 0x746C6644ui64);
    }
  }
}

Referenced by: