PsGetPreviousProcess

NTSTATUS __stdcall PsGetPreviousProcess(PVOID Object){
  _ETHREAD *CurrentThread; 
  __int64 *v3; 
  int v4; 
  __int64 *v5; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v3 = 0i64;
  v4 = 0;
  PspLockProcessListShared(CurrentThread);
  v5 = (__int64 *)qword_140C1E078;
  if( Object )
    v5 = (__int64 *)*((_QWORD *)Object + 138);
  while( v5 != &PsActiveProcessHead )
  {
    v3 = v5 - 137;
    if( ObReferenceObjectSafeWithTag((INT64)(v5 - 137), 1850045264i64) )
    {
      v4 = 1;
      break;
    }
    v5 = (__int64 *)v5[1];
  }
  PspUnlockProcessListShared(CurrentThread);
  if( Object )
    ObfDereferenceObjectWithTag(Object, 0x6E457350ui64);
  return(unsigned __int64)v3 & -(__int64)(v4 != 0);
}

Referenced by: