PsLookupProcessByProcessId

NTSTATUS __stdcall PsLookupProcessByProcessId(VOID *ProcessId, PEPROCESS *Process){
  PEPROCESS *v2; 
  _ETHREAD *CurrentThread; 
  _EPROCESS *v4; 
  _EJOB *CurrentServerSilo; 
  _EJOB *v6; 
  bool v7; 
  int v9[10]; 

  v2 = Process;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.SpecialApcDisable;
  LOBYTE(Process) = 3;
  v4 = (_EPROCESS *)PspReferenceCidTableEntry(ProcessId, (INT64)Process);
  if( v4 )
  {
    CurrentServerSilo = PsGetCurrentServerSilo();
    v6 = CurrentServerSilo;
    if( (v4->Flags & 0x4000000) != 0 )
    {
      if( PsIsProcessInSilo(v4, CurrentServerSilo) )
        goto LABEL_4;
LABEL_14:
      ObfDereferenceObjectWithTag(v4, 0x746C6644ui64);
      v4 = 0i64;
      goto LABEL_4;
    }
    _InterlockedOr(v9, 0);
    if( (v4->ProcessLock._bf_0 & 1) != 0 )
      ExfAcquireReleasePushLockExclusive(&v4->ProcessLock);
    if( (v4->Flags & 0x4000000) == 0 || !PsIsProcessInSilo(v4, v6) )
      goto LABEL_14;
  }
LABEL_4:
  v7 = CurrentThread->Tcb.SpecialApcDisable++ == -1;
  if( v7
    && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)CurrentThread->Tcb.ApcState.ApcListHead[0].Flink != &CurrentThread->Tcb.152 )
  {
    KiCheckForKernelApcDelivery();
  }
  if( !v4 )
    return -1073741813;
  *v2 = v4;
  return 0;
}

Referenced by: