PsGetNextProcess

_LIST_ENTRY *__fastcall PsGetNextProcess(_EPROCESS *Process){
  _ETHREAD *CurrentThread; 
  __int64 *v2; 
  int v3; 
  __int64 *Flink; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v2 = 0i64;
  v3 = 0;
  --CurrentThread->Tcb.SpecialApcDisable;
  ExAcquirePushLockSharedEx((_EX_PUSH_LOCK *)&PspActiveProcessLock, 0i64);
  Flink = (__int64 *)PsActiveProcessHead;
  if( Process )
    Flink = (__int64 *)Process->ActiveProcessLinks.Flink;
  while( Flink != &PsActiveProcessHead )
  {
    v2 = Flink - 137;
    if( ObReferenceObjectSafeWithTag((INT64)(Flink - 137), 1850045264i64) )
    {
      v3 = 1;
      break;
    }
    Flink = (__int64 *)*Flink;
  }
  PspUnlockProcessListShared(CurrentThread);
  if( Process )
    ObfDereferenceObjectWithTag(Process, 0x6E457350ui64);
  return(_LIST_ENTRY *)((unsigned __int64)v2 & -(__int64)(v3 != 0));
}

Referenced by: