ObInitProcess

NTSTATUS __stdcall ObInitProcess(
        _EX_RUNDOWN_REF *ParentProcess,
        ULONG_PTR NewProcess,
        UINT64 DuplicateArraySize,
        VOID **DuplicateArray){
  unsigned int v5; 
  _EPROCESS *v6; 
  _HANDLE_TABLE *v8; 
  int v9; 
  _HANDLE_TABLE *v10; 
  _HANDLE_TABLE *v12; 
  __int64 v13[5]; 
  _HANDLE_TABLE *HandleTable; 

  HandleTable = 0i64;
  v5 = DuplicateArraySize;
  v6 = *(_EPROCESS **)&NewProcess;
  if( !ParentProcess )
  {
    v8 = 0i64;
    v10 = ExCreateHandleTable(*(_EPROCESS **)&NewProcess, 1ui64);
LABEL_5:
    if( v10 )
    {
      v6->ObjectTable = v10;
      if( SeAuditingWithTokenForSubcategory(123i64, 0i64) )
      {
        v13[0] = (__int64)v6;
        v13[1] = (__int64)ParentProcess;
        ExEnumHandleTable(
          v10,
          (__int64(__fastcall *)(_HANDLE_TABLE *, _HANDLE_TABLE_ENTRY *, _EXHANDLE, __int64))ObAuditInheritedHandleProcedure,
          (__int64)v13,
          0i64);
      }
      if( v8 )
        ExReleaseRundownProtection(ParentProcess + 139);
      return 0;
    }
    else
    {
      v6->ObjectTable = 0i64;
      if( v8 )
        ExReleaseRundownProtection(ParentProcess + 139);
      return -1073741670;
    }
  }
  v8 = ObReferenceProcessHandleTable((_EPROCESS *)ParentProcess);
  if( !v8 )
    return -1073741558;
  v9 = ExDupHandleTable(v6, v8, v5, DuplicateArray, &HandleTable);
  if( v9 >= 0 )
  {
    v10 = HandleTable;
    goto LABEL_5;
  }
  ExReleaseRundownProtection(ParentProcess + 139);
  v12 = HandleTable;
  if( HandleTable )
  {
    ExSweepHandleTable(v6, HandleTable, 0);
    ExpRemoveHandleTable(v12);
    ExpFreeHandleTable(v12);
  }
  return v9;
}

Referenced by: