WheaTerminateProcess

NTSTATUS __stdcall WheaTerminateProcess(){
  _EPROCESS *Process; 
  _OBJECT_NAME_INFORMATION *ImageFileName; 
  const wchar_t *v2; 
  int v3; 
  int v4; 
  int ProcessId; 

  Process = KeGetCurrentThread()->ApcState.Process;
  ImageFileName = Process->SeAuditProcessCreationInfo.ImageFileName;
  v2 = (const wchar_t *)*((_QWORD *)ImageFileName + 1);
  if( v2 )
  {
    v3 = *(_WORD *)ImageFileName;
  }
  else
  {
    v2 = L"(Unknown)";
    v3 = 4;
  }
  v4 = PsTerminateProcess((ULONG_PTR)Process, 0xC0000713ui64);
  if( v4 >= 0 )
  {
    ProcessId = (unsigned int)PsGetProcessId(Process);
    WheapLogProcessTerminateEvent(ProcessId, (__int64)v2, v3);
  }
  return v4;
}

Referenced by: