PspCaptureProcessParameters
NTSTATUS __stdcall PspCaptureProcessParameters(
INT8 PreviousMode,
_RTL_USER_PROCESS_PARAMETERS *UserProcessParameters,
PSP_CREATE_PROCESS_CONTEXT *CreateContext){
char v3;
NTSTATUS result;
char v6;
v3 = *((_BYTE *)CreateContext + 8);
if( PreviousMode )
{
result = PspCaptureUserProcessParameters(
(_RTL_USER_PROCESS_PARAMETERS **)CreateContext + 26,
UserProcessParameters,
*((_QWORD *)CreateContext + 64));
if( result < 0 )
return result;
v6 = *((_BYTE *)CreateContext + 8);
if( (v6 & 8) != 0 )
*((_BYTE *)CreateContext + 9) &= 0xF3u;
*((_BYTE *)CreateContext + 8) = v6 | 4;
}
else
{
*((_QWORD *)CreateContext + 26) = UserProcessParameters;
*((_BYTE *)CreateContext + 8) = v3 & 0xFB;
}
return 0;
}Referenced by:
NtCreateUserProcess