PspProcessOpen

INT64 __stdcall PspProcessOpen(
        _OB_OPEN_REASON OpenReason,
        CHAR AccessMode,
        _EPROCESS *TargetProcess,
        PVOID Object,
        UINT64 *GrantedAccess,
        UINT64 HandleCount){
  bool IsParentProcess; 
  __int64 v10; 
  unsigned int v11; 
  unsigned int v12; 
  int v13; 
  IsParentProcess = PspIsParentProcess((INT64)TargetProcess, (INT64)Object);
  v12 = v11 & 0xFFFFFFFE;
  if( !IsParentProcess )
    v12 = v11;
  if( (v12 & *(_DWORD *)GrantedAccess) != 0
    && PsTestProtectedProcessIncompatibility((unsigned __int8)AccessMode, (__int64)TargetProcess, v10) )
  {
    return 3221225506i64;
  }
  if( *((_QWORD *)Object + 280)
    && !*((_QWORD *)TargetProcess + 280)
    && AccessMode
    && (~DWORD2(xmmword_140C1DE80) & *(_DWORD *)GrantedAccess) != 0 )
  {
    return 3221225506i64;
  }
  v13 = *(_DWORD *)GrantedAccess;
  if( (*(_DWORD *)GrantedAccess & 1) != 0 && AccessMode == 1 && (*((_DWORD *)Object + 543) & 0x8000000) != 0 )
    return 3221225506i64;
  if( (*(_DWORD *)GrantedAccess & 0x28) == 40 || (*(_DWORD *)GrantedAccess & 0x400) != 0 )
  {
    v13 |= 0x1000u;
    *(_DWORD *)GrantedAccess = v13;
  }
  if( (v13 & 0x200) != 0 )
    *(_DWORD *)GrantedAccess = v13 | 0x2000;
  return 0i64;
}

Referenced by: