PsOpenProcess

__int64 __fastcall PsOpenProcess(VOID **a1, unsigned int a2, __int64 a3, _OWORD *a4, char a5, CHAR a6){
  int v10; 
  __int64 v11; 
  bool v12; 
  char v13; 
  CHAR v14; 
  int v15; 
  NTSTATUS v16; 
  int v17; 
  _GENERIC_MAPPING *GenericMapping; 
  _EPROCESS *v19; 
  int v20; 
  INT8 v21; 
  _LUID v22; 
  INT8 v23; 
  INT8 v24; 
  NTSTATUS v25; 
  _GENERIC_MAPPING *v26; 
  int v27; 
  int v28; 
  _KPROCESSOR_MODE AccessMode; 
  char v31; 
  CHAR v32; 
  UINT64 DesiredAccess; 
  int v34; 
  _EPROCESS *Process; 
  unsigned int v36; 
  int UniqueProcessId; 
  unsigned int v38; 
  UINT64 v39; 
  int v40; 
  int v41; 
  NTSTATUS v42; 
  PADAPTER_OBJECT DmaAdapter; 
  VOID *Handle; 
  VOID *ProcessId[2]; 
  __int64 v46; 
  VOID **v47; 
  _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  _SECURITY_SUBJECT_CONTEXT SubjectSecurityContext; 
  PRIVILEGE_SET RequiredPrivileges; 
  int v51[40]; 
  _AUX_ACCESS_DATA AuxData; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  int *v54; 
  __int64 v55; 
  int *v56; 
  __int64 v57; 
  _EVENT_DATA_DESCRIPTOR v58; 
  unsigned int *v59; 
  __int64 v60; 
  UINT64 *v61; 
  __int64 v62; 
  __int64 v63; 
  __int64 v64; 
  char *v65; 
  __int64 v66; 
  char *v67; 
  __int64 v68; 
  __int64 *v69; 
  __int64 v70; 

  LODWORD(DesiredAccess) = a2;
  v47 = a1;
  v36 = a2;
  memset(v51, 0i64, sizeof(v51));
  memset(&AuxData, 0i64, sizeof(AuxData));
  *(_OWORD *)ProcessId = 0i64;
  Handle = 0i64;
  DmaAdapter = 0i64;
  v10 = 0;
  v34 = 0;
  Process = 0i64;
  UniqueProcessId = -1;
  if( a5 )
  {
    v11 = (__int64)a1;
    if( (unsigned __int64)a1 >= 0x7FFFFFFF0000i64 )
      v11 = 0x7FFFFFFF0000i64;
    *(_QWORD *)v11 = *(_QWORD *)v11;
    if( (a3 & 3) != 0 )
      ExRaiseDatatypeMisalignment();
    v12 = *(_QWORD *)(a3 + 16) != 0i64;
    HIDWORD(DesiredAccess) = *(_DWORD *)(a3 + 24) & 0x1DF2;
    if( a4 )
    {
      if( ((unsigned __int8)a4 & 3) != 0 )
        ExRaiseDatatypeMisalignment();
      *(_OWORD *)ProcessId = *a4;
      v13 = 1;
    }
    else
    {
      v13 = 0;
    }
    v14 = a6;
  }
  else
  {
    v12 = *(_QWORD *)(a3 + 16) != 0i64;
    v15 = 73714;
    v14 = a6;
    if( a6 )
      v15 = 7666;
    HIDWORD(DesiredAccess) = *(_DWORD *)(a3 + 24) & v15;
    if( a4 )
    {
      *(_OWORD *)ProcessId = *a4;
      v13 = 1;
    }
    else
    {
      v13 = 0;
    }
  }
  if( v12 || !v13 )
  {
    v16 = -1073741776;
    goto LABEL_45;
  }
  if( ProcessId[1] )
  {
    v16 = PsLookupProcessThreadByCid((__int64)ProcessId, (_MDL **)&Process, &DmaAdapter);
    if( v16 >= 0 )
    {
      HalPutDmaAdapter(DmaAdapter);
      goto LABEL_21;
    }
LABEL_45:
    v28 = DesiredAccess;
    goto LABEL_46;
  }
  v16 = PsLookupProcessByProcessId(ProcessId[0], &Process);
  if( v16 < 0 )
    goto LABEL_45;
LABEL_21:
  UniqueProcessId = (int)Process->UniqueProcessId;
  v17 = 0;
  GenericMapping = (_GENERIC_MAPPING *)((char *)PsProcessType + 76);
  v19 = KeGetCurrentThread()->ApcState.Process;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  SeCaptureSubjectContextEx((PETHREAD)KeGetCurrentThread(), v19, &SubjectContext);
  SepCreateAccessStateFromSubjectContext(&SubjectContext, (_ACCESS_STATE *)v51, &AuxData, a2, GenericMapping);
  v16 = v20;
  if( v20 < 0 )
  {
LABEL_38:
    v10 = 0;
    goto LABEL_45;
  }
  v10 = 1;
  v34 = 1;
  while( 1 )
  {
    if( (DesiredAccess & 0x40000000000i64) == 0 || (v21 = 1, v17) )
      v21 = v14;
    v22 = SeDebugPrivilege;
    memset(&SubjectSecurityContext, 0, sizeof(SubjectSecurityContext));
    SeCaptureSubjectContextEx(
      (PETHREAD)KeGetCurrentThread(),
      KeGetCurrentThread()->ApcState.Process,
      &SubjectSecurityContext);
    RequiredPrivileges.PrivilegeCount = 1;
    RequiredPrivileges.Control = 1;
    RequiredPrivileges.Privilege[0].Luid = v22;
    RequiredPrivileges.Privilege[0].Attributes = 0;
    v23 = SePrivilegeCheck((UINT64 *)&RequiredPrivileges.PrivilegeCount, (INT64)&SubjectSecurityContext, v21);
    v24 = v23;
    if( v21 )
      SePrivilegedServiceAuditAlarm(0i64, &SubjectSecurityContext, &RequiredPrivileges, v23);
    SeReleaseSubjectContext(&SubjectSecurityContext);
    if( v24 )
    {
      if( (v51[4] & 0x2000000) != 0 )
        v51[5] |= 0x1FFFFFu;
      else
        v51[5] |= v51[4];
      v51[4] = 0;
    }
    LOBYTE(AccessMode) = v14;
    v25 = ObOpenObjectByPointer(
            Process,
            HIDWORD(DesiredAccess),
            (PACCESS_STATE)v51,
            0,
            (POBJECT_TYPE)PsProcessType,
            AccessMode,
            &Handle);
    v16 = v25;
    if( v25 >= 0 )
      break;
    if( (DesiredAccess & 0x40000000000i64) == 0 || v25 != -1073741790 || v17 )
      goto LABEL_45;
    v17 = 1;
    SeDeleteAccessState((_ACCESS_STATE *)v51);
    v26 = (_GENERIC_MAPPING *)((char *)PsProcessType + 76);
    memset(&SubjectContext, 0, sizeof(SubjectContext));
    SeCaptureSubjectContextEx((PETHREAD)KeGetCurrentThread(), KeGetCurrentThread()->ApcState.Process, &SubjectContext);
    SepCreateAccessStateFromSubjectContext(
      &SubjectContext,
      (_ACCESS_STATE *)v51,
      &AuxData,
      (unsigned int)DesiredAccess,
      v26);
    v16 = v27;
    if( v27 < 0 )
      goto LABEL_38;
  }
  if( v17 && *(&stru_140C00F40 + 732) > 5u && tlgKeywordOn((__int64)&stru_140C00F40 + 2928, 0x400000000000i64) )
  {
    v38 = (unsigned int)PsGetProcessId(Process);
    v59 = &v38;
    v60 = 4i64;
    v39 = DesiredAccess;
    v61 = &v39;
    v62 = 4i64;
    v63 = (__int64)&v39 + 4;
    v64 = 4i64;
    v31 = a5;
    v65 = &v31;
    v66 = 1i64;
    v32 = v14;
    v67 = &v32;
    v68 = 1i64;
    v46 = 0x1000000i64;
    v69 = &v46;
    v70 = 8i64;
    tlgWriteTransfer_EtwWriteTransfer(
      (__int64)&stru_140C00F40 + 2928,
      (unsigned __int8 *)&word_14002B29E,
      0i64,
      0i64,
      8u,
      &v58);
  }
  *v47 = Handle;
  v28 = DesiredAccess;
LABEL_46:
  v42 = v16;
  v41 = v28;
  v40 = UniqueProcessId;
  UserData.Ptr = (unsigned __int64)&v40;
  *(_QWORD *)&UserData.Size = 4i64;
  v54 = &v41;
  v55 = 4i64;
  v56 = &v42;
  v57 = 4i64;
  EtwWrite(*(&ExBootDevicesRemovedEvent + 379), &KERNEL_AUDIT_API_OPENPROCESS, 0, 3u, &UserData);
  if( v10 )
    SeDeleteAccessState((_ACCESS_STATE *)v51);
  if( Process )
    HalPutDmaAdapter((PADAPTER_OBJECT)Process);
  return(unsigned int)v16;
}

Referenced by: