ObCheckRefTraceProcess

NTSTATUS __fastcall ObCheckRefTraceProcess(__int64 a1){
  NTSTATUS result; 
  const char *ProcessImageFileName; 
  INT8 v4; 
  _ETHREAD *CurrentThread; 
  struct _STRING DestinationString; 
  UNICODE_STRING String1; 
  DestinationString = 0i64;
  String1 = 0i64;
  if( (ObpTraceFlags & 0x20) == 0 )
    return 0;
  ProcessImageFileName = (const char *)PsGetProcessImageFileName(a1);
  RtlInitAnsiString(&DestinationString, ProcessImageFileName, v4);
  if( !DestinationString.Length )
    return 0;
  result = RtlAnsiStringToUnicodeString(&String1, &DestinationString, 1u);
  if( result >= 0 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 243);
    ExAcquirePushLockExclusiveEx((UINT64)&ObpStackTraceLock, 0i64);
    if( (ObpTraceFlags & 0x20) != 0 && (unsigned __int8)RtlPrefixUnicodeString(&String1, (INT64 *)ObpTraceProcessName) )
      _InterlockedOr((volatile signed __int32 *)(a1 + 1120), 0x200u);
    if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&ObpStackTraceLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((volatile INT64 *)&ObpStackTraceLock);
    KeAbPostRelease(&ObpStackTraceLock);
    KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
    RtlFreeAnsiString(&String1);
    return 0;
  }
  return result;
}

Referenced by: