NtCreateProcessEx

NTSTATUS __stdcall NtCreateProcessEx(
        VOID **ProcessHandle,
        UINT64 DesiredAccess,
        _OBJECT_ATTRIBUTES *ObjectAttributes,
        VOID *ParentProcess,
        UINT64 Flags,
        VOID *SectionHandle,
        VOID *DebugPort,
        VOID *TokenHandle,
        UINT64 JobMemberLevel){
  unsigned int v9; 
  char PreviousMode; 
  __int64 v13; 
  UINT64 CreateFlags; 
  VOID *v15; 

  v9 = DesiredAccess;
  if( !ParentProcess )
    return -1073741811;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( PreviousMode )
  {
    v13 = 0x7FFFFFFF0000i64;
    if( (unsigned __int64)ProcessHandle < 0x7FFFFFFF0000i64 )
      v13 = (__int64)ProcessHandle;
    *(_QWORD *)v13 = *(_QWORD *)v13;
  }
  LODWORD(v15) = Flags;
  LOBYTE(CreateFlags) = PreviousMode;
  return PspCreateProcess(
           ProcessHandle,
           v9,
           ObjectAttributes,
           ParentProcess,
           CreateFlags,
           v15,
           SectionHandle,
           DebugPort);
}

Referenced by: