PopEtGetProcessImageInfo

INT64 __fastcall PopEtGetProcessImageInfo(INT64 a1, INT64 a2){
  void *ProcessSectionBaseAddress; 
  IMAGE_NT_HEADERS *v4; 
  *(_QWORD *)a2 = 0i64;
  if( (*(_DWORD *)(a1 + 2172) & 1) == 0 )
  {
    ProcessSectionBaseAddress = (void *)PsGetProcessSectionBaseAddress(a1);
    if( ProcessSectionBaseAddress )
    {
      v4 = RtlImageNtHeader(ProcessSectionBaseAddress);
      if( v4 )
      {
        *(_DWORD *)a2 = v4->OptionalHeader.CheckSum;
        *(_DWORD *)(a2 + 4) = v4->FileHeader.TimeDateStamp;
      }
    }
  }
  return 0i64;
}

Referenced by: