NtAcquireProcessActivityReference

NTSTATUS __fastcall NtAcquireProcessActivityReference(INT64 *a1, VOID *a2, INT64 a3){
  INT8 v5; 
  __int64 v6; 
  NTSTATUS result; 
  PVOID v8; 
  int ActivityReference; 
  __int64 v10[3]; 
  PVOID Object; 
  v10[0] = 0i64;
  Object = 0i64;
  v5 = *((_BYTE *)KeGetCurrentThread() + 562);
  if( v5 )
  {
    v6 = 0x7FFFFFFF0000i64;
    if( (unsigned __int64)a1 < 0x7FFFFFFF0000i64 )
      v6 = (__int64)a1;
    *(_QWORD *)v6 = *(_QWORD *)v6;
  }
  if( (_DWORD)a3 )
    return -1073741583;
  result = ExCpuSetResourceManagerAccessCheck(v5);
  if( result >= 0 )
  {
    result = ObReferenceObjectByHandleWithTag(a2, 0x1000u, (POBJECT_TYPE)PsProcessType, v5, 0x63417350u, &Object, 0i64);
    if( result >= 0 )
    {
      v8 = Object;
      ActivityReference = PspCreateActivityReference(Object, (INT64)v10);
      if( ActivityReference >= 0 )
        *a1 = v10[0];
      ObfDereferenceObjectWithTag(v8, 0x63417350ui64);
      return ActivityReference;
    }
  }
  return result;
}

Referenced by: