ZwOpenProcess

NTSTATUS __stdcall ZwOpenProcess(
        PHANDLE ProcessHandle,
        _ACCESS_MASK DesiredAccess,
        POBJECT_ATTRIBUTES ObjectAttributes,
        PCLIENT_ID ClientId){
  NTSTATUS result; 

  _disable();
  __readeflags();
  KiServiceInternal();
  return result;
}

Referenced by:

BiLogFileOwnerProcess
SepRmLsaConnectRequest