NtTerminateProcess

NTSTATUS __stdcall NtTerminateProcess(PVOID ProcessHandle, INT64 ExitStatus){
  _ETHREAD *CurrentThread; 
  unsigned int v3; 
  unsigned int v4; 
  ULONG_PTR v5; 
  KPROCESSOR_MODE v6; 
  NTSTATUS result; 
  _EPROCESS *v8; 
  unsigned int v9; 
  unsigned int v10; 
  signed __int32 v11; 
  signed __int32 v12; 
  PVOID Object; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v3 = 0;
  Object = 0i64;
  v4 = ExitStatus;
  v5 = *((_QWORD *)CurrentThread + 23);
  v6 = *((_BYTE *)CurrentThread + 562);
  if( ProcessHandle )
  {
    result = ObReferenceObjectByHandleWithTag(
               ProcessHandle,
               1u,
               (POBJECT_TYPE)PsProcessType,
               v6,
               0x65547350u,
               &Object,
               0i64);
    if( result < 0 )
      return result;
    if( !v6 && (*(_BYTE *)(v5 + 992) & 1) == 0 )
      v3 = 1;
    v8 = (_EPROCESS *)Object;
  }
  else
  {
    Object = (PVOID)*((_QWORD *)CurrentThread + 23);
    v8 = (_EPROCESS *)v5;
    if( v6 != 1 && (*(_BYTE *)(v5 + 992) & 1) == 0 || (*(_DWORD *)(v5 + 2172) & 1) != 0 )
      return -1073741637;
    if( (*((_BYTE *)CurrentThread + 3) & 0x40) == 0 )
    {
      PspLockProcessExclusive(v5, (__int64)CurrentThread);
      _m_prefetchw((const void *)(v5 + 1124));
      v11 = *(_DWORD *)(v5 + 1124);
      do
      {
        v12 = v11;
        v11 = _InterlockedCompareExchange((volatile signed __int32 *)(v5 + 1124), v11 | 0x40000000, v11);
      }
      while( v12 != v11 );
      if( (v11 & 0x40000008) != 0 )
      {
        PspUnlockProcessExclusive(v5, (__int64)CurrentThread);
        PspTerminateThreadByPointer((ULONG_PTR)CurrentThread, v4, 1);
        return 0;
      }
      *((_DWORD *)CurrentThread + 325) |= 0x40u;
      if( *(_DWORD *)(v5 + 2004) == 259 )
        *(_DWORD *)(v5 + 2004) = v4;
      PspUnlockProcessExclusiveUnsafe(v5);
      v10 = PspTerminateAllThreads(v5, (ULONG_PTR)CurrentThread, v4, 0);
      goto LABEL_17;
    }
    ObfReferenceObjectWithTag((PVOID)v5, 0x65547350u);
  }
  v9 = *((_DWORD *)v8 + 272);
  --*((_WORD *)CurrentThread + 242);
  v10 = PspTerminateProcess(v8, CurrentThread, v4, v3);
  ObfDereferenceObjectWithTag(v8, 0x65547350ui64);
  if( v8 == (_EPROCESS *)v5 )
  {
    if( v6 == 1 || (*(_BYTE *)(v5 + 992) & 1) != 0 )
    {
      _InterlockedOr((volatile signed __int32 *)CurrentThread + 324, 1u);
      KeForceResumeThread((_KTHREAD *)CurrentThread);
      KeLeaveCriticalRegionThread((__int64)CurrentThread);
      PspExitThread(v4);
      __debugbreak();
    }
  }
  else
  {
    PspLogAuditTerminateRemoteProcessEvent(v9, v10);
  }
LABEL_17:
  KeLeaveCriticalRegionThread((__int64)CurrentThread);
  return v10;
}

Referenced by: