EtwpGetPsmKeyExtendedHeaderItem

INT64 __fastcall EtwpGetPsmKeyExtendedHeaderItem(__int64 a1){
  __int64 v2; 
  __int64 v3; 
  struct DMA_ADAPTER *v4; 
  int v5; 
  UINT64 v6; 
  UINT8 SystemAppIdentifier; 
  UINT8 PackagedApplication; 
  UINT64 PsmKeySize; 
  SystemAppIdentifier = 0;
  PsmKeySize = 0i64;
  v2 = *((_QWORD *)KeGetCurrentThread() + 23);
  v3 = 8i64;
  v4 = (struct DMA_ADAPTER *)PsReferencePrimaryToken((PEPROCESS)v2);
  PsQueryProcessAttributesByToken(v4, &SystemAppIdentifier, &PackagedApplication);
  if( SystemAppIdentifier )
  {
    PsmKeySize = 466i64;
    v5 = EtwpQueryPsmKey(v4, (WCHAR *)(a1 + 8), &PsmKeySize);
    v6 = PsmKeySize;
    if( v5 < 0 )
      v6 = 0i64;
    v3 = v6 + 8;
  }
  else
  {
    LOWORD(v6) = PsmKeySize;
  }
  ObFastDereferenceObject((INT64 *)(v2 + 1208), v4);
  *(_DWORD *)(a1 + 2) = 9;
  *(_WORD *)(a1 + 6) = v6;
  *(_WORD *)a1 = (v3 + 7) & 0xFFF8;
  return memset(v3 + a1, 0i64);
}

Referenced by: