PsCreateMinimalProcess

INT64 __fastcall PsCreateMinimalProcess(
        _EPROCESS *Parent,
        _UNICODE_STRING *ProcessName,
        _PS_PROTECTION Protection,
        VOID *Token,
        UINT64 CreateFlags,
        VOID **ProcessHandle){
  ULONG_PTR v7; 
  struct _DMA_ADAPTER *v8; 
  char v9; 
  __int64 v10; 
  signed int MemoryPartitionContext; 
  _EPROCESS *v12; 
  char v13; 
  _EPROCESS *PROCESS; 
  INT64 a3; 
  PVOID a5; 
  __int64 v18; 
  const void **v19; 
  __int64 v20; 
  _QWORD *v21; 
  INT64 result[48]; 
  int v23; 
  __int64 v24; 
  struct _KAPC_STATE ApcState; 
  unsigned int ProcessHandlea; 
  char v27[8]; 
  __int64 v28; 
  __int64 v29; 
  _QWORD *v30; 
  v7 = v29;
  v20 = *(_QWORD *)&Protection;
  v19 = (const void **)ProcessName;
  a3 = v29;
  v8 = (struct _DMA_ADAPTER *)CreateFlags;
  v21 = v30;
  v18 = 0i64;
  v9 = (char)Token;
  memset(&ApcState, 0, sizeof(ApcState));
  memset((INT64)result, 0i64);
  a5 = 0i64;
  PROCESS = 0i64;
  if( !CreateFlags )
    v8 = (struct _DMA_ADAPTER *)PsReferencePrimaryToken((PEPROCESS)Parent);
  v10 = CreateFlags != 0;
  ProcessHandlea = (unsigned int)ProcessHandle | 0x800;
  MemoryPartitionContext = PspGetMemoryPartitionContext((INT64)Parent, ProcessHandlea, (INT64)&a3, v29 != 0, &a5);
  if( MemoryPartitionContext >= 0 )
  {
    MemoryPartitionContext = PspAllocateProcess(
                               (__int64)Parent,
                               0,
                               0i64,
                               v9,
                               0,
                               0,
                               0i64,
                               v8,
                               ProcessHandlea,
                               v27[0],
                               0i64,
                               CreateFlags != 0,
                               a5,
                               (__int64)&v18,
                               &PROCESS);
    if( MemoryPartitionContext < 0 )
    {
      PROCESS = 0i64;
    }
    else
    {
      if( v28 )
        *((_QWORD *)PROCESS + 280) = v28;
      v12 = PROCESS;
      if( (*((_DWORD *)PROCESS + 543) & 1) != 0 && !*((_QWORD *)PROCESS + 280) && (unsigned int)KeKvaShadowingActive() )
      {
        *((_BYTE *)v12 + 912) = 1;
        if( !_interlockedbittestandset((volatile signed __int32 *)PROCESS + 543, 0xEu) )
        {
          KeStackAttachProcess((PRKPROCESS)PROCESS, &ApcState);
          MmSynchronizeAddressPolicy((UINT64)PROCESS);
          KeUnstackDetachProcess(&ApcState);
        }
        v7 = a3;
        v12 = PROCESS;
      }
      if( v19 )
      {
        PspSetMinimalProcessName((__int64)v12, v19);
        v12 = PROCESS;
      }
      v13 = 1;
      if( (_DWORD)v18 )
        v13 = 3;
      MemoryPartitionContext = PspInsertProcess((PADAPTER_OBJECT)v12, 0i64, v13, v20, (PACCESS_STATE)result);
      if( MemoryPartitionContext < 0 )
      {
        PspRundownSingleProcess((ULONG_PTR)PROCESS, 0);
      }
      else
      {
        LODWORD(v10) = v10 | 4;
        if( !v7
          || (MemoryPartitionContext = PsAssignProcessToJobObject(v7, PROCESS, 0i64), MemoryPartitionContext >= 0) )
        {
          DbgkCreateMinimalProcess((PEPROCESS)PROCESS);
          LODWORD(v10) = v10 | 2;
          v23 |= 0x200u;
          MemoryPartitionContext = PspCreateObjectHandle(PROCESS, (INT64)result, (struct OBJECT_TYPE *)PsProcessType);
          if( MemoryPartitionContext >= 0 )
          {
            LODWORD(v10) = v10 & 0xFFFFFFFB;
            *v21 = v24;
          }
        }
      }
    }
  }
  if( (v10 & 2) != 0 )
    PspDeleteObjectAccessState((ACCESS_STATE *)result);
  if( PROCESS )
  {
    if( (unsigned int)v10 >= 4 )
      PsTerminateProcess((ULONG_PTR)PROCESS, MemoryPartitionContext);
    ObfDereferenceObjectWithTag(PROCESS, 0x72437350ui64);
  }
  if( a5 )
    PspDeleteMemoryPartitionContext(a5);
  if( (v10 & 1) == 0 )
    HalPutDmaAdapter(v8);
  return(unsigned int)MemoryPartitionContext;
}

Referenced by: