PsReferenceProcessFilePointer

NTSTATUS __stdcall PsReferenceProcessFilePointer(_EPROCESS *Process, VOID **OutFileObject){
  _EX_RUNDOWN_REF *p_RundownProtect; 
  _SECTION *SectionObject; 
  _CONTROL_AREA *v6; 
  _FILE_OBJECT *v7; 
  NTSTATUS result; 

  p_RundownProtect = &Process->RundownProtect;
  if( ExAcquireRundownProtection(&Process->RundownProtect) )
  {
    SectionObject = (_SECTION *)Process->SectionObject;
    if( SectionObject )
    {
      v6 = MiSectionControlArea(SectionObject);
      v7 = MiReferenceControlAreaFile(v6);
      ExReleaseRundownProtection(p_RundownProtect);
      result = 0;
      *OutFileObject = v7;
      return result;
    }
    ExReleaseRundownProtection(p_RundownProtect);
  }
  return -1073741823;
}

Referenced by: