PsLookupProcessByProcessId

NTSTATUS __stdcall PsLookupProcessByProcessId(HANDLE ProcessId, PEPROCESS *Process){
  _ETHREAD *CurrentThread; 
  __int64 v4; 
  __int64 v5; 
  _EJOB *CurrentServerSilo; 
  __int64 v7; 
  bool v8; 
  int v10[10]; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 243);
  LODWORD(v4) = PspReferenceCidTableEntry(ProcessId, 3u);
  v5 = v4;
  if( v4 )
  {
    CurrentServerSilo = PsGetCurrentServerSilo();
    v7 = (__int64)CurrentServerSilo;
    if( (*(_DWORD *)(v5 + 1124) & 0x4000000) != 0 )
    {
      if( PsIsProcessInSilo(v5, (__int64)CurrentServerSilo) )
        goto LABEL_4;
LABEL_14:
      ObfDereferenceObjectWithTag((PVOID)v5, 0x746C6644ui64);
      v5 = 0i64;
      goto LABEL_4;
    }
    _InterlockedOr(v10, 0);
    if( (*(_QWORD *)(v5 + 1080) & 1) != 0 )
      ExfAcquireReleasePushLockExclusive((VOID *)(v5 + 1080));
    if( (*(_DWORD *)(v5 + 1124) & 0x4000000) == 0 || !PsIsProcessInSilo(v5, v7) )
      goto LABEL_14;
  }
LABEL_4:
  v8 = (*((_WORD *)CurrentThread + 243))++ == 0xFFFF;
  if( v8 && *((_ETHREAD **)CurrentThread + 19) != (_ETHREAD *)((char *)CurrentThread + 152) )
    KiCheckForKernelApcDelivery();
  if( !v5 )
    return -1073741813;
  *Process = (PEPROCESS)v5;
  return 0;
}

Referenced by: