PspTerminateProcess

INT64 __stdcall PspTerminateProcess(_EPROCESS *Process, _ETHREAD *CurrentThread, INT64 Status, UINT64 Flags){
  int v4; 
  unsigned int v5; 
  signed __int32 v8; 
  int v9; 
  unsigned int v10; 
  unsigned int v11; 
  unsigned int v12; 
  v4 = Flags;
  v5 = Status;
  _m_prefetchw((char *)Process + 1124);
  v8 = _InterlockedOr((volatile signed __int32 *)Process + 281, 8u);
  if( (v8 & 8) != 0 )
  {
    v10 = Flags | 2;
  }
  else
  {
    KeSetProcessSchedulingGroup((_KPROCESS *)Process, 0i64);
    v9 = v4 | 4;
    if( (v8 & 0x40000000) == 0 )
      v9 = v4;
    v10 = v9;
    ExAcquirePushLockExclusiveEx((UINT64)Process + 1080, 0i64);
    if( *((_DWORD *)Process + 380) && (v5 != -1073741749 || *((_DWORD *)Process + 501) == 259) )
      *((_DWORD *)Process + 501) = v5;
    if( (_InterlockedExchangeAdd64((volatile signed __int64 *)Process + 135, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((volatile INT64 *)Process + 135);
    KeAbPostRelease((char *)Process + 1080);
  }
  if( (*((_DWORD *)Process + 280) & 0x400) == 0 )
  {
    v11 = PspTerminateAllThreads((ULONG_PTR)Process, (ULONG_PTR)CurrentThread, v5, v10);
LABEL_12:
    v12 = v11;
    goto LABEL_13;
  }
  if( *((_QWORD *)&xmmword_140C1DE60 + 1) && (v10 & 8) == 0 )
  {
    v11 = (*((__int64(__fastcall **)(_EPROCESS *, _QWORD))&xmmword_140C1DE60 + 1))(Process, v5);
    goto LABEL_12;
  }
  v12 = 290;
  PspRundownSingleProcess((ULONG_PTR)Process, 0);
LABEL_13:
  if( (v8 & 8) == 0 )
    KeForceResumeProcess((_KPROCESS *)Process);
  return v12;
}

Referenced by: