PspCaptureProcessParameters

NTSTATUS __stdcall PspCaptureProcessParameters(
        INT8 PreviousMode,
        _RTL_USER_PROCESS_PARAMETERS *UserProcessParameters,
        PSP_CREATE_PROCESS_CONTEXT *CreateContext){
  char v3; 
  NTSTATUS result; 
  char v6; 

  v3 = *((_BYTE *)CreateContext + 8);
  if( PreviousMode )
  {
    result = PspCaptureUserProcessParameters(
               (_RTL_USER_PROCESS_PARAMETERS **)CreateContext + 26,
               UserProcessParameters,
               *((_QWORD *)CreateContext + 64));
    if( result < 0 )
      return result;
    v6 = *((_BYTE *)CreateContext + 8);
    if( (v6 & 8) != 0 )
      *((_BYTE *)CreateContext + 9) &= 0xF3u;
    *((_BYTE *)CreateContext + 8) = v6 | 4;
  }
  else
  {
    *((_QWORD *)CreateContext + 26) = UserProcessParameters;
    *((_BYTE *)CreateContext + 8) = v3 & 0xFB;
  }
  return 0;
}

Referenced by:

NtCreateUserProcess