NtGetNextProcess

NTSTATUS __stdcall NtGetNextProcess(
        VOID *ProcessHandle,
        UINT64 DesiredAccess,
        UINT64 HandleAttributes,
        UINT64 Flags,
        VOID **NewProcessHandle){
  int v5; 
  int v6; 
  char PreviousMode; 
  unsigned int v9; 
  __int64 v10; 
  NTSTATUS result; 
  int v12; 
  _LIST_ENTRY *NextProcess; 
  _EPROCESS *v14; 
  _ETHREAD *CurrentThread; 
  _EJOB *CurrentServerSilo; 
  int v17; 
  _LIST_ENTRY *v18; 
  bool v19; 
  UINT64 Tag; 
  _KPROCESSOR_MODE Object; 
  bool v22; 
  unsigned int DesiredAccessa; 
  PVOID v24; 
  VOID *Handle; 
  _EJOB *v26; 
  _ETHREAD *v27; 
  int v28[40]; 
  _AUX_ACCESS_DATA AuxData; 

  v5 = Flags;
  v6 = HandleAttributes;
  DesiredAccessa = DesiredAccess;
  v24 = 0i64;
  memset(v28, 0i64, sizeof(v28));
  memset(&AuxData, 0i64, sizeof(AuxData));
  Handle = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  v9 = v6 & (PreviousMode != 0 ? 7666 : 73714);
  if( PreviousMode )
  {
    v10 = (__int64)NewProcessHandle;
    if( (unsigned __int64)NewProcessHandle >= 0x7FFFFFFF0000i64 )
      v10 = 0x7FFFFFFF0000i64;
    *(_QWORD *)v10 = *(_QWORD *)v10;
  }
  *NewProcessHandle = 0i64;
  if( (v5 & 0xFFFFFFFE) != 0 )
    return -1073741811;
  if( !ProcessHandle
    || (LODWORD(Tag) = 1850045264,
        result = ObReferenceObjectByHandleWithTag(
                   ProcessHandle,
                   0i64,
                   (_OBJECT_TYPE *)PsProcessType,
                   PreviousMode,
                   Tag,
                   &v24,
                   0i64),
        result >= 0) )
  {
    v12 = v5 & 1;
    if( v12 )
      LODWORD(NextProcess) = PsGetPreviousProcess(v24);
    else
      NextProcess = PsGetNextProcess((_EPROCESS *)v24);
    v14 = (_EPROCESS *)NextProcess;
    if( !NextProcess )
      return -2147483622;
    v22 = SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, PreviousMode) != 0;
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    v27 = CurrentThread;
    CurrentServerSilo = PsGetCurrentServerSilo();
    v26 = CurrentServerSilo;
    while( 1 )
    {
      if( (v14->Flags & 0x4000000) != 0 )
        goto LABEL_13;
      PspLockUnlockProcessExclusive(v14, CurrentThread);
      if( (v14->Flags & 0x4000000) != 0 )
        break;
LABEL_27:
      if( v12 )
        LODWORD(v18) = PsGetPreviousProcess(v14);
      else
        v18 = PsGetNextProcess(v14);
      v14 = (_EPROCESS *)v18;
      v19 = v18 == 0i64;
      CurrentServerSilo = v26;
      if( v19 )
      {
        v17 = -2147483622;
LABEL_21:
        if( v14 )
          ObfDereferenceObjectWithTag(v14, 0x6E457350ui64);
        return v17;
      }
    }
    CurrentServerSilo = v26;
LABEL_13:
    if( PsIsProcessInSilo(v14, CurrentServerSilo) )
    {
      v17 = SeCreateAccessState(
              (_ACCESS_STATE *)v28,
              &AuxData,
              DesiredAccessa,
              (_GENERIC_MAPPING *)((char *)PsProcessType + 76));
      if( v17 < 0 )
        goto LABEL_21;
      if( v22 )
      {
        if( (v28[4] & 0x2000000) != 0 )
          v28[5] |= 0x1FFFFFu;
        else
          v28[5] |= v28[4];
        v28[4] = 0;
      }
      LOBYTE(Object) = PreviousMode;
      v17 = ObOpenObjectByPointer(v14, v9, (PACCESS_STATE)v28, 0, (POBJECT_TYPE)PsProcessType, Object, &Handle);
      SeDeleteAccessState((_ACCESS_STATE *)v28);
      if( v17 >= 0 )
      {
        *NewProcessHandle = Handle;
        goto LABEL_21;
      }
      if( v17 != -1073741790 )
        goto LABEL_21;
      CurrentThread = v27;
    }
    goto LABEL_27;
  }
  return result;
}

Referenced by: