EtwpQueryProcessOtherInfo

VOID __stdcall EtwpQueryProcessOtherInfo(_EPROCESS *Process, _ETW_OTHER_PROCESS_INFO *OtherInfo){
  VOID *ProcessSectionBaseAddress; 
  __int64 v4; 

  *OtherInfo = 0i64;
  ProcessSectionBaseAddress = PsGetProcessSectionBaseAddress(Process);
  if( ProcessSectionBaseAddress )
  {
    LODWORD(v4) = RtlImageNtHeader((UINT64)ProcessSectionBaseAddress);
    if( v4 )
    {
      OtherInfo->ImageChecksum = *(_DWORD *)(v4 + 88);
      OtherInfo->TimeDateStamp = *(_DWORD *)(v4 + 8);
    }
  }
}

Referenced by: