PspTerminateProcess

NTSTATUS __stdcall PspTerminateProcess(PVOID Process, PVOID CurrentThread, UINT64 Status, UINT64 Flags){
  int v4; 
  unsigned int v5; 
  ULONG_PTR v6; 
  signed __int32 v8; 
  int v9; 
  unsigned int v10; 
  NTSTATUS v11; 
  NTSTATUS v12; 

  v4 = Flags;
  v5 = Status;
  v6 = (unsigned int)CurrentThread;
  _m_prefetchw((char *)Process + 1124);
  v8 = _InterlockedOr((volatile signed __int32 *)Process + 281, 8u);
  if( (v8 & 8) != 0 )
  {
    v10 = Flags | 2;
  }
  else
  {
    KeSetProcessSchedulingGroup((_KPROCESS *)Process, 0i64);
    v9 = v4 | 4;
    if( (v8 & 0x40000000) == 0 )
      v9 = v4;
    v10 = v9;
    ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)Process + 135, 0i64);
    if( *((_DWORD *)Process + 380) && (v5 != -1073741749 || *((_DWORD *)Process + 501) == 259) )
      *((_DWORD *)Process + 501) = v5;
    if( (_InterlockedExchangeAdd64((volatile signed __int64 *)Process + 135, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((_EX_PUSH_LOCK *)Process + 135);
    KeAbPostRelease((char *)Process + 1080);
  }
  if( (*((_DWORD *)Process + 280) & 0x400) == 0 )
  {
    v11 = PspTerminateAllThreads((ULONG_PTR)Process, v6, v5, v10);
LABEL_12:
    v12 = v11;
    goto LABEL_13;
  }
  if( *((_QWORD *)&xmmword_140C1DE60 + 1) && (v10 & 8) == 0 )
  {
    v11 = (*((__int64(__fastcall **)(PVOID, _QWORD))&xmmword_140C1DE60 + 1))(Process, v5);
    goto LABEL_12;
  }
  v12 = 290;
  PspRundownSingleProcess((_EPROCESS *)Process, 0);
LABEL_13:
  if( (v8 & 8) == 0 )
    KeForceResumeProcess((_KPROCESS *)Process);
  return v12;
}

Referenced by: