NtQueryInformationProcess

NTSTATUS __fastcall NtQueryInformationProcess(INT64 a1, INT64 a2, INT64 a3, UINT64 a4, UINT64 *ReturnLength){
  __int64 v5; 
  unsigned __int64 p_ProcessInformation; 
  PROCESSINFOCLASS v7; 
  unsigned __int64 Peb; 
  unsigned __int8 v10; 
  __int64 v11; 
  __int64 v12; 
  NTSTATUS result; 
  int v14; 
  int DeviceMapInformation; 
  _EX_RUNDOWN_REF *v16; 
  _FILE_OBJECT *v17; 
  int FileDosDeviceName; 
  const VOID **v19; 
  unsigned int v20; 
  unsigned __int64 v21; 
  _EPROCESS *v22; 
  VOID *v23; 
  int v24; 
  __int64 v25; 
  unsigned __int64 Group; 
  _EWOW64PROCESS *WoW64Process; 
  unsigned __int16 Machine; 
  $1F247424BFCF625481CFD4988DD60FD2 *v29; 
  int v30; 
  int v31; 
  int v32; 
  _EPROCESS *v33; 
  _EPROCESS *v34; 
  _EX_RUNDOWN_REF *v35; 
  unsigned int v36; 
  __int64 v37; 
  int v38; 
  _DWORD *v39; 
  VOID *v40; 
  int ProcessHandleCount; 
  void *v42; 
  _EPROCESS *v43; 
  UINT64 v44; 
  NTSTATUS v45; 
  NTSTATUS v46; 
  int v47; 
  int v48; 
  unsigned int v49; 
  NTSTATUS SessionId; 
  unsigned __int64 *v51; 
  int v52; 
  __int64 v53; 
  NTSTATUS v54; 
  _EPROCESS *v55; 
  _HANDLE_TABLE *v56; 
  _HANDLE_TABLE *v57; 
  _HANDLE_TRACE_DEBUG_INFO *v58; 
  _HANDLE_TRACE_DEBUG_INFO *v59; 
  __int64 v60; 
  int *v61; 
  __int64 v62; 
  int v63; 
  VOID *v64; 
  _EPROCESS *CurrentProcess; 
  VOID *v66; 
  _ADAPTER_OBJECT *v67; 
  int ContiguousTranslations; 
  struct _KPRCB *CurrentPrcb; 
  int PerformanceCounter; 
  int v71; 
  unsigned __int64 v72; 
  _EX_RUNDOWN_REF *v73; 
  _ADAPTER_OBJECT *Count; 
  NTSTATUS v75; 
  VOID *v76; 
  __int64 v77; 
  __int64 v78; 
  __int64 v79; 
  VOID *v80; 
  int ProcessHandleInformation; 
  _ADAPTER_OBJECT *v82; 
  _HALP_DMA_TRANSLATION_BUFFER *v83; 
  _ADAPTER_OBJECT *v84; 
  _HALP_DMA_TRANSLATION_BUFFER *v85; 
  NTSTATUS v86; 
  int v87; 
  int v88; 
  __int64 v89; 
  unsigned __int64 v90; 
  unsigned int v91; 
  VOID *v92; 
  unsigned int v93; 
  unsigned int v94; 
  NTSTATUS v95; 
  __int64 v96; 
  _EPROCESS *v97; 
  _EWOW64PROCESS *v98; 
  UINT64 v99; 
  __int64 p_WindowFlags; 
  __int64 p_WindowTitle; 
  unsigned int v102; 
  _EPROCESS *v103; 
  int v104; 
  _EPROCESS *v105; 
  _HANDLE_TABLE *v106; 
  int v107; 
  _DWORD *v108; 
  int v109; 
  _HANDLE_TABLE *v110; 
  int v111; 
  int v112; 
  _DWORD *v113; 
  int v114; 
  int v115; 
  int v116; 
  _DWORD *v117; 
  int v118; 
  int v119; 
  int v120; 
  _DWORD *v121; 
  int v122; 
  int v123; 
  int v124; 
  int v125; 
  _DWORD *v126; 
  int v127; 
  NTSTATUS v128; 
  int v129; 
  int v130; 
  int v131; 
  NTSTATUS RedirectionTrustPolicy; 
  int v133; 
  int v134; 
  _DWORD *v135; 
  int v136; 
  _DWORD *v137; 
  int v138; 
  _DWORD *v139; 
  int v140; 
  NTSTATUS v141; 
  _HANDLE_TABLE *v142; 
  _EPROCESS *v143; 
  int v144; 
  _EPROCESS *v145; 
  _HANDLE_TABLE *v146; 
  INT64 v147; 
  VOID *v148; 
  NTSTATUS ProcessCommandLine; 
  CHAR v150; 
  _HANDLE_TABLE *v151; 
  UINT64 v152; 
  unsigned int v153; 
  _EPROCESS *v154; 
  NTSTATUS NoChildProcessRestrictedPolicy; 
  int v156; 
  int v157; 
  _QWORD *ExtensionTable; 
  int v159; 
  __int64(__fastcall *v160)(_QWORD, _QWORD); 
  VOID *v161; 
  _DWORD *v162; 
  int v163; 
  int v164; 
  int v165; 
  VOID *v166; 
  size_t v167; 
  __int64 v168; 
  _EPROCESS *v169; 
  unsigned __int64 v170; 
  _ETHREAD *v171; 
  unsigned __int64 v172; 
  int v173; 
  size_t v174; 
  __int64 v175; 
  _KPROCESS *v176; 
  _PEB *v177; 
  _DWORD *v178; 
  _EWOW64PROCESS *v179; 
  int v180; 
  signed __int32 v181; 
  ULONG Tag[2]; 
  PVOID *Object; 
  PVOID Process; 
  NTSTATUS i; 
  UINT8 SystemAppIdentifier[2]; 
  UINT8 HandleExceptionsOn; 
  UINT8 HandleExceptionsPermanent; 
  UINT64 GroupMask[2]; 
  UINT64 DataLength; 
  VOID *LockVariable; 
  __int16 v192; 
  UINT64 ExecuteOptions; 
  volatile signed __int32 *v194; 
  int v195; 
  PVOID P; 
  VOID *Handle; 
  _ETHREAD *Thread; 
  VOID *OutFileObject; 
  UINT64 UserTime; 
  int v201; 
  _PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY SignaturePolicy; 
  UINT64 EligibleOut; 
  VOID *v204; 
  __int64 v205; 
  INT64 v206; 
  VOID *FromAddress[2]; 
  UINT64 CommitDebtOut[2]; 
  UINT64 MemResetCommittedPagesOut[2]; 
  UINT64 HardEnforcementFlags; 
  int v211; 
  UINT64 MinimumWorkingSetSize; 
  UINT64 MaximumWorkingSetSize; 
  _LARGE_INTEGER CurrentTime; 
  _RTL_USER_PROCESS_PARAMETERS *ProcessParameters; 
  PVOID v216; 
  VOID *LockedBuffer; 
  UINT64 CycleTimeStamp[2]; 
  PADAPTER_OBJECT DmaAdapter; 
  PVOID v220; 
  __int128 v221[3]; 
  __int64 v222; 
  __int64 v223[2]; 
  unsigned __int64 LastAppStateUpdateTime; 
  unsigned __int64 v225; 
  VOID *v226; 
  unsigned __int64 TotalFrozenUnbiasedTime; 
  __int64 v228; 
  int v229; 
  int v230; 
  INT64 v231; 
  __int64 v232; 
  UINT64 NumberOfBytesRead; 
  __int128 v234; 
  int v235; 
  __int128 v236; 
  __int128 v237; 
  __int128 v238; 
  __int128 Src; 
  UINT64 PeakWorkingSetSize[2]; 
  UINT64 WorkingSetSize[2]; 
  UINT64 Usage[2]; 
  UINT64 v243[2]; 
  __int128 v244; 
  UINT64 PrivateWorkingSetSize[2]; 
  _PS_DEEP_FREEZE_STATS DeepFreezeStats; 
  _EPROCESS_VALUES Values; 
  unsigned __int64 v248; 
  _UNICODE_STRING ProcessInformation; 
  __int64 v250; 
  VOID *v251; 
  __int128 v252; 
  __int128 v253; 
  __int128 v254; 
  __int128 v255; 
  __int128 v256; 
  __int128 v257; 
  __int128 v258; 
  __int128 v259; 
  __int128 v260; 
  __int128 v261; 
  __int64 v262; 
  int v263; 
  __int128 JobObjectInformation; 
  __int128 v265; 
  __int64 v266; 
  _KAPC_STATE ApcState; 
  _KAPC_STATE v268; 
  INT64 v269[2]; 
  __int128 v270; 
  __int128 v271; 
  __int128 v272; 
  __int128 v273; 
  __int128 v274; 
  __int128 v275; 
  __int128 v276; 
  __int128 v277; 
  __int64 v278; 
  INT64 v279[2]; 
  __int128 v280; 
  __int128 v281; 
  __int128 v282; 
  __int128 v283; 
  __int128 v284; 
  __int128 v285; 
  __int128 v286; 
  __int128 v287; 
  _KAFFINITY_EX Affinity; 
  _KAFFINITY_EX v289; 
  char EnergyValues[432]; 
  UINT64 CpuSets[20]; 

  v5 = (unsigned int)a4;
  p_ProcessInformation = a3;
  v7 = (int)a2;
  GroupMask[1] = a1;
  v206 = a3;
  v231 = a3;
  v211 = a4;
  v194 = (volatile signed __int32 *)ReturnLength;
  memset(&ApcState, 0, sizeof(ApcState));
  Peb = 0i64;
  LODWORD(DataLength) = 0;
  Handle = 0i64;
  LODWORD(ExecuteOptions) = 0;
  memset(&v289, 0i64, sizeof(v289));
  OutFileObject = 0i64;
  LODWORD(GroupMask[0]) = 0;
  LODWORD(HardEnforcementFlags) = 0;
  v229 = 0;
  v236 = 0i64;
  v237 = 0i64;
  v238 = 0i64;
  *(_OWORD *)v269 = 0i64;
  v270 = 0i64;
  v271 = 0i64;
  v272 = 0i64;
  v273 = 0i64;
  v274 = 0i64;
  v275 = 0i64;
  v276 = 0i64;
  v277 = 0i64;
  v278 = 0i64;
  memset(&v221[1], 0, 32);
  v222 = 0i64;
  v205 = 0i64;
  ProcessInformation = 0i64;
  MaximumWorkingSetSize = 0i64;
  JobObjectInformation = 0i64;
  v265 = 0i64;
  v266 = 0i64;
  MinimumWorkingSetSize = 0i64;
  P = 0i64;
  v192 = 0;
  Process = 0i64;
  CycleTimeStamp[0] = 0i64;
  LODWORD(UserTime) = 0;
  memset(&Values, 0, sizeof(Values));
  Src = 0i64;
  *(_OWORD *)PeakWorkingSetSize = 0i64;
  *(_OWORD *)WorkingSetSize = 0i64;
  *(_OWORD *)Usage = 0i64;
  *(_OWORD *)v243 = 0i64;
  v244 = 0i64;
  *(_OWORD *)PrivateWorkingSetSize = 0i64;
  v10 = KeGetCurrentThread()->$87BC921A506A176A34DE473FC146A343::gap0[10];
  SystemAppIdentifier[1] = v10;
  Thread = (_ETHREAD *)KeGetCurrentThread();
  if( !v10 )
    goto LABEL_23;
  if( v7 == ProcessProtectionInformation )
  {
LABEL_13:
    v11 = 0i64;
    goto LABEL_14;
  }
  if( v7 != ProcessCommitReleaseInformation )
  {
    if( ((v7 - 70) & 0xFFFFFFFB) != 0 )
    {
      if( v7 == (ProcessIumChallengeResponse|ProcessHandleCount) )
      {
        v11 = 7i64;
      }
      else if( v7 == (ProcessHighGraphicsPriorityInformation|ProcessHandleCount) )
      {
        v11 = 7i64;
      }
      else
      {
        v11 = 3i64;
        if( v7 == (ProcessRaiseUMExceptionOnInvalidHandleClose|ProcessUserModeIOPL) )
          v11 = 0i64;
      }
      goto LABEL_14;
    }
    goto LABEL_13;
  }
  v11 = 7i64;
LABEL_14:
  if( (_DWORD)v5 )
  {
    if( (v11 & p_ProcessInformation) != 0 )
      ExRaiseDatatypeMisalignment();
    if( p_ProcessInformation + v5 > 0x7FFFFFFF0000i64 || p_ProcessInformation + v5 < p_ProcessInformation )
      MEMORY[0x7FFFFFFF0000] = 0;
  }
  if( ReturnLength )
  {
    v12 = (__int64)ReturnLength;
    if( (unsigned __int64)ReturnLength >= 0x7FFFFFFF0000i64 )
      v12 = 0x7FFFFFFF0000i64;
    *(_DWORD *)v12 = *(_DWORD *)v12;
  }
LABEL_23:
  switch( v7 )
  {
    case ProcessBasicInformation:
      memset(&Affinity, 0i64, sizeof(Affinity));
      SystemAppIdentifier[0] = 0;
      if( (_DWORD)v5 == 64 )
      {
        v21 = p_ProcessInformation;
        P = (PVOID)p_ProcessInformation;
        LODWORD(v5) = 64;
        *(_QWORD *)p_ProcessInformation = 64i64;
        p_ProcessInformation += 8i64;
      }
      else
      {
        if( (_DWORD)v5 != 48 )
          return -1073741820;
        v21 = 0i64;
        P = 0i64;
      }
      LODWORD(DataLength) = v5;
      LockVariable = (VOID *)p_ProcessInformation;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      FileDosDeviceName = result;
      i = result;
      if( result < 0 )
        return result;
      v22 = (_EPROCESS *)Process;
      *(_DWORD *)p_ProcessInformation = *((_DWORD *)Process + 501);
      *(_QWORD *)(p_ProcessInformation + 8) = v22->Peb;
      if( (*(_BYTE *)&v22->Pcb.SecureState & 1) != 0 )
        VslGetSecurePebAddress((__int64)v22, (_QWORD *)(p_ProcessInformation + 8));
      v23 = v22;
      if( FileDosDeviceName >= 0 )
      {
        LockVariable = 0i64;
        KeQueryGroupMaskProcess(v22);
        LODWORD(GroupMask[0]) = v24;
        if( ((v24 - 1) & v24) == 0 || v22 == Thread->Tcb.Process )
        {
          KeQueryAffinityProcess(&v22->Pcb, &Affinity, GroupMask, 0i64);
          v25 = LODWORD(GroupMask[0]);
          if( ((LODWORD(GroupMask[0]) - 1) & GroupMask[0]) == 0 )
          {
            _BitScanForward((unsigned int *)&Group, GroupMask[0]);
            goto LABEL_69;
          }
          if( v22 == Thread->Tcb.Process )
          {
            Group = Thread->Tcb.UserAffinity.Group;
            if( _bittest64(&v25, Group) )
            {
LABEL_69:
              if( (_DWORD)Group != 20 )
                LockVariable = (VOID *)Affinity.Bitmap[Group];
            }
          }
        }
        if( v21 )
          PsQueryProcessAttributes(v22, SystemAppIdentifier, 0i64);
        *(_QWORD *)(p_ProcessInformation + 16) = LockVariable;
        *(_DWORD *)(p_ProcessInformation + 24) = v22->Pcb.BasePriority;
        *(_QWORD *)(p_ProcessInformation + 32) = v22->UniqueProcessId;
        *(_QWORD *)(p_ProcessInformation + 40) = v22->InheritedFromUniqueProcessId;
        if( v21 )
        {
          *(_DWORD *)(v21 + 56) = 0;
          if( (unsigned int)PsIsProtectedProcess(v22) )
          {
            *(_DWORD *)(v21 + 56) = 1;
            LODWORD(Peb) = 1;
          }
          WoW64Process = v22->WoW64Process;
          if( WoW64Process )
          {
            Machine = WoW64Process->Machine;
            if( Machine == 332 || Machine == 452 )
              *(_DWORD *)(v21 + 56) = Peb | 2;
          }
          v29 = &v22->1124;
          if( (v22->Flags & 0x40000008) != 0 )
            *(_DWORD *)(v21 + 56) |= 4u;
          v22 = (_EPROCESS *)Process;
          v30 = *(_DWORD *)(v21 + 56) ^ ((unsigned __int8)*(_DWORD *)(v21 + 56) ^ (unsigned __int8)(*((_DWORD *)Process + 280) >> 4)) & 8;
          *(_DWORD *)(v21 + 56) = v30;
          if( v22->Pcb.FreezeCount + (((unsigned __int32)v22->Pcb._bf_0 >> 3) & 1) )
          {
            v30 |= 0x10u;
            *(_DWORD *)(v21 + 56) = v30;
          }
          v31 = v30 ^ ((unsigned __int8)v30 ^ (unsigned __int8)(v29->Flags >> 15)) & 0x20;
          *(_DWORD *)(v21 + 56) = v31;
          if( SystemAppIdentifier[0] )
          {
            v31 |= 0x40u;
            *(_DWORD *)(v21 + 56) = v31;
          }
          if( (*(_BYTE *)&v22->Pcb.SecureState & 1) != 0 )
          {
            v31 |= 0x80u;
            *(_DWORD *)(v21 + 56) = v31;
          }
          if( v22->PicoContext )
            *(_DWORD *)(v21 + 56) = v31 | 0x100;
          FileDosDeviceName = i;
        }
        if( ReturnLength )
          *(_DWORD *)ReturnLength = v5;
        goto LABEL_538;
      }
LABEL_554:
      ObfDereferenceObjectWithTag(v23, 0x79517350ui64);
      return FileDosDeviceName;
    case ProcessQuotaLimits:
      return PspQueryQuotaLimits(
               (VOID *)a1,
               (VOID *)0x7FFFFFFF0000i64,
               (VOID *)p_ProcessInformation,
               (unsigned int)v5,
               (INT64)ReturnLength,
               v10);
    case ProcessIoCounters:
      if( (_DWORD)v5 != 48 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      DeviceMapInformation = result;
      if( result < 0 )
        return result;
      PsQueryStatisticsProcess((_EPROCESS *)Process, &Values);
      v236 = *(_OWORD *)&Values.ReadOperationCount;
      v237 = *(_OWORD *)&Values.OtherOperationCount;
      v238 = *(_OWORD *)&Values.WriteTransferCount;
      ObfDereferenceObjectWithTag(Process, 0x79517350ui64);
      *(_OWORD *)p_ProcessInformation = v236;
      *(_OWORD *)(p_ProcessInformation + 16) = v237;
      *(_OWORD *)(p_ProcessInformation + 32) = v238;
      if( ReturnLength )
        *(_DWORD *)ReturnLength = 48;
      return DeviceMapInformation;
    case ProcessVmCounters:
      if( (((_DWORD)v5 - 88) & 0xFFFFFFE7) != 0 || (_DWORD)v5 == 104 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      if( result < 0 )
        return result;
      v33 = (_EPROCESS *)Process;
      Src = *((_OWORD *)Process + 73);
      LODWORD(PeakWorkingSetSize[0]) = *((_DWORD *)Process + 417);
      KeStackAttachProcess((PRKPROCESS)Process, &ApcState);
      i = MmQueryWorkingSetInformation(
            &PeakWorkingSetSize[1],
            WorkingSetSize,
            PrivateWorkingSetSize,
            &MinimumWorkingSetSize,
            &MaximumWorkingSetSize,
            &HardEnforcementFlags);
      KeUnstackDetachProcess(&ApcState);
      PsQueryProcessQuotaCounters(v33, PsResourcePagedPool, Usage, &WorkingSetSize[1]);
      PsQueryProcessQuotaCounters(v34, PsResourceNonPagedPool, v243, &Usage[1]);
      v243[1] = v33->CommitCharge << 12;
      *(_QWORD *)&v244 = *((_QWORD *)Process + 202) << 12;
      PrivateWorkingSetSize[1] = *((_QWORD *)Process + 293) << 12;
      *((_QWORD *)&v244 + 1) = v243[1];
      ObfDereferenceObjectWithTag(Process, 0x79517350ui64);
      result = i;
      if( i < 0 )
        return result;
      memmove((VOID *)p_ProcessInformation, &Src, v5);
      if( ReturnLength )
        *(_DWORD *)ReturnLength = v5;
      return 0;
    case ProcessTimes:
      if( (_DWORD)v5 != 32 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      DeviceMapInformation = result;
      if( result < 0 )
        return result;
      v35 = (_EX_RUNDOWN_REF *)Process;
      v36 = PsQueryRuntimeProcess((_EPROCESS *)Process, &UserTime);
      v37 = (unsigned int)KeMaximumIncrement;
      *(_QWORD *)(p_ProcessInformation + 16) = (unsigned int)KeMaximumIncrement * (unsigned __int64)v36;
      *(_QWORD *)(p_ProcessInformation + 24) = v37 * (unsigned int)UserTime;
      *(_EX_RUNDOWN_REF *)p_ProcessInformation = v35[141];
      *(_EX_RUNDOWN_REF *)(p_ProcessInformation + 8) = v35[264];
      if( ReturnLength )
        *(_DWORD *)ReturnLength = 32;
      goto LABEL_355;
    case ProcessDebugPort:
      if( (_DWORD)v5 != 8 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x400ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      if( result < 0 )
        return result;
      Handle = (VOID *)((unsigned __int128)-(__int128)*((unsigned __int64 *)Process + 175) >> 64);
      ObfDereferenceObjectWithTag(Process, 0x79517350ui64);
      *(_QWORD *)p_ProcessInformation = Handle;
      if( ReturnLength )
        *(_DWORD *)ReturnLength = 8;
      return 0;
    case ProcessLdtInformation:
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x410ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      if( result < 0 )
        return result;
      v45 = xKdEnumerateDebuggingDevices(v43, v42, v44);
      goto LABEL_150;
    case ProcessDefaultHardErrorMode:
      if( (_DWORD)v5 != 4 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      if( result < 0 )
        return result;
      v32 = *((_DWORD *)Process + 382);
      ObfDereferenceObjectWithTag(Process, 0x79517350ui64);
      *(_DWORD *)p_ProcessInformation = v32;
      if( ReturnLength )
        *(_DWORD *)ReturnLength = 4;
      return 0;
    case ProcessPooledUsageAndLimits:
      return PspQueryPooledQuotaLimits((VOID *)a1, (VOID *)p_ProcessInformation, (unsigned int)v5, ReturnLength, v10);
    case ProcessWorkingSetWatch:
    case ProcessWorkingSetWatchEx:
      return PspQueryWorkingSetWatch((VOID *)a1, v7, (VOID *)p_ProcessInformation, (unsigned int)v5, ReturnLength, v10);
    case ProcessPriorityClass:
      if( (_DWORD)v5 != 2 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      if( result < 0 )
        return result;
      HIBYTE(v192) = *((_BYTE *)Process + 1463);
      ObfDereferenceObjectWithTag(Process, 0x79517350ui64);
      *(_WORD *)p_ProcessInformation = v192;
      if( ReturnLength )
        *(_DWORD *)ReturnLength = 2;
      return 0;
    case ProcessWx86Information:
      if( (_DWORD)v5 != 4 )
        return -1073741820;
      Tag[0] = 2035381072;
      DeviceMapInformation = ObReferenceObjectByHandleWithTag(
                               (VOID *)a1,
                               0x400ui64,
                               (_OBJECT_TYPE *)PsProcessType,
                               v10,
                               *(UINT64 *)Tag,
                               &Process,
                               0i64);
      if( DeviceMapInformation >= 0 )
      {
        v47 = *((_BYTE *)Process + 1127) & 1;
        ObfDereferenceObjectWithTag(Process, 0x79517350ui64);
        *(_DWORD *)p_ProcessInformation = v47;
        if( ReturnLength )
          *(_DWORD *)ReturnLength = 4;
      }
      return DeviceMapInformation;
    case ProcessHandleCount:
      HIDWORD(UserTime) = 0;
      if( (((_DWORD)v5 - 4) & 0xFFFFFFFB) != 0 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      if( result < 0 )
        return result;
      ProcessHandleCount = ObGetProcessHandleCount((_EX_RUNDOWN_REF *)Process, (UINT64 *)((char *)&UserTime + 4));
      ObfDereferenceObjectWithTag(Process, 0x79517350ui64);
      *(_DWORD *)p_ProcessInformation = ProcessHandleCount;
      if( (_DWORD)v5 != 4 )
        *(_DWORD *)(p_ProcessInformation + 4) = HIDWORD(UserTime);
      if( ReturnLength )
        *(_DWORD *)ReturnLength = 4;
      return 0;
    case ProcessAffinityMask:
      if( (((_DWORD)v5 - 8) & 0xFFFFFFF7) != 0 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      DeviceMapInformation = result;
      if( result < 0 )
        return result;
      v35 = (_EX_RUNDOWN_REF *)Process;
      KeQueryGroupMaskProcess((_EPROCESS *)Process);
      LODWORD(GroupMask[0]) = v88;
      if( ((v88 - 1) & v88) != 0
        || (KeQueryAffinityProcess((_KPROCESS *)v35, &v289, GroupMask, 0i64),
            ((LODWORD(GroupMask[0]) - 1) & GroupMask[0]) != 0) )
      {
        ObfDereferenceObjectWithTag(v35, 0x79517350ui64);
        return -1073741811;
      }
      _BitScanForward((unsigned int *)&v89, GroupMask[0]);
      v90 = v289.Bitmap[v89];
      if( (_DWORD)v5 == 16 )
        *(_WORD *)(p_ProcessInformation + 8) = v89;
      *(_QWORD *)p_ProcessInformation = v90;
      if( ReturnLength )
        *(_DWORD *)ReturnLength = v5;
      goto LABEL_355;
    case ProcessPriorityBoost:
      if( (_DWORD)v5 != 4 )
        return -1073741820;
      Tag[0] = 2035381072;
      DeviceMapInformation = ObReferenceObjectByHandleWithTag(
                               (VOID *)a1,
                               0x1000ui64,
                               (_OBJECT_TYPE *)PsProcessType,
                               v10,
                               *(UINT64 *)Tag,
                               &Process,
                               0i64);
      if( DeviceMapInformation >= 0 )
      {
        v48 = (*((_DWORD *)Process + 158) >> 1) & 1;
        ObfDereferenceObjectWithTag(Process, 0x79517350ui64);
        *(_DWORD *)p_ProcessInformation = v48;
        if( ReturnLength )
          *(_DWORD *)ReturnLength = 4;
      }
      return DeviceMapInformation;
    case ProcessDeviceMap:
      if( (unsigned int)v5 < 0x24 )
        return -1073741820;
      if( (_DWORD)v5 == 48 )
      {
        HIDWORD(ExecuteOptions) = *(_DWORD *)(p_ProcessInformation + 40);
        v49 = HIDWORD(ExecuteOptions);
        if( (ExecuteOptions & 0xFFFFFFFE00000000ui64) != 0 )
          return -1073741811;
      }
      else
      {
        if( (_DWORD)v5 != 36 )
          return -1073741820;
        v49 = 0;
      }
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x400ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      if( result < 0 )
        return result;
      DeviceMapInformation = ObQueryDeviceMapInformation((_KPROCESS *)Process, (VOID *)p_ProcessInformation, v49);
      ObfDereferenceObjectWithTag(Process, 0x79517350ui64);
      if( DeviceMapInformation >= 0 && ReturnLength )
        *(_DWORD *)ReturnLength = v5;
      return DeviceMapInformation;
    case ProcessSessionInformation:
      if( (_DWORD)v5 != 4 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      if( result < 0 )
        return result;
      SessionId = MmGetSessionId((_EPROCESS *)Process);
      ObfDereferenceObjectWithTag(Process, 0x79517350ui64);
      *(_DWORD *)p_ProcessInformation = SessionId;
      if( ReturnLength )
        *(_DWORD *)ReturnLength = 4;
      return 0;
    case ProcessWow64Information:
      if( (_DWORD)v5 != 8 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      if( result < 0 )
        return result;
      v51 = (unsigned __int64 *)*((_QWORD *)Process + 176);
      if( v51 )
        Peb = *v51;
      ObfDereferenceObjectWithTag(Process, 0x79517350ui64);
      *(_QWORD *)p_ProcessInformation = Peb;
      if( ReturnLength )
        *(_DWORD *)ReturnLength = 8;
      return 0;
    case ProcessImageFileName:
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      if( result < 0 )
        return result;
      if( (unsigned int)v5 >= 0x10 )
      {
        v14 = v5 - 16;
      }
      else
      {
        p_ProcessInformation = (unsigned __int64)&ProcessInformation;
        v14 = 0;
      }
      if( (unsigned int)v5 >= 0x10 )
        Peb = v231 + 16;
      LODWORD(DataLength) = v14;
      DeviceMapInformation = PsQueryFullProcessImageName(
                               (_EPROCESS *)Process,
                               (_UNICODE_STRING *)p_ProcessInformation,
                               (WCHAR *)Peb,
                               &DataLength);
      ObfDereferenceObjectWithTag(Process, 0x79517350ui64);
      if( DeviceMapInformation >= 0 && !Peb )
        DeviceMapInformation = -1073741820;
      if( ReturnLength && ((int)(DeviceMapInformation + 0x80000000) < 0 || DeviceMapInformation == -1073741820) )
        *(_DWORD *)ReturnLength = DataLength + 16;
      return DeviceMapInformation;
    case ProcessLUIDDeviceMapsEnabled:
      if( (_DWORD)v5 != 4 )
        return -1073741820;
      *(_DWORD *)p_ProcessInformation = 1;
      if( ReturnLength )
        *(_DWORD *)ReturnLength = 4;
      return 0;
    case ProcessBreakOnTermination:
      if( (_DWORD)v5 != 4 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      if( result < 0 )
        return result;
      v52 = (*((_DWORD *)Process + 281) >> 13) & 1;
      ObfDereferenceObjectWithTag(Process, 0x79517350ui64);
      *(_DWORD *)p_ProcessInformation = v52;
      if( ReturnLength )
        *(_DWORD *)ReturnLength = 4;
      return 0;
    case ProcessDebugObjectHandle:
      if( (_DWORD)v5 != 8 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x400ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      if( result < 0 )
        return result;
      DeviceMapInformation = DbgkOpenProcessDebugPort((_EPROCESS *)Process, v10, &Handle);
      v40 = Handle;
      if( DeviceMapInformation < 0 )
        v40 = 0i64;
      Handle = v40;
      ObfDereferenceObjectWithTag(Process, 0x79517350ui64);
      *(_QWORD *)p_ProcessInformation = Handle;
      if( ReturnLength )
        *(_DWORD *)ReturnLength = 8;
      return DeviceMapInformation;
    case ProcessDebugFlags:
      if( (_DWORD)v5 != 4 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x400ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      v38 = result;
      if( result < 0 )
        return result;
      v39 = Process;
      *(_DWORD *)p_ProcessInformation = (*((_DWORD *)Process + 281) & 2) == 0;
      if( ReturnLength )
        *(_DWORD *)ReturnLength = 4;
      goto LABEL_122;
    case ProcessHandleTracing:
      if( (unsigned int)v5 < 0x10 )
        return -1073741820;
      if( (unsigned int)ExIsRestrictedCaller(v10) )
        return -1073741790;
      LockVariable = (VOID *)((unsigned int)(v5 - 16) / 0xA0ui64);
      v53 = p_ProcessInformation + 16;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x400ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      v54 = result;
      if( result >= 0 )
      {
        v55 = (_EPROCESS *)Process;
        v56 = ObReferenceProcessHandleTable((_EPROCESS *)Process);
        v57 = v56;
        MinimumWorkingSetSize = (UINT64)v56;
        if( v56 )
        {
          v58 = ExReferenceHandleDebugInfo(v56);
          v59 = v58;
          MaximumWorkingSetSize = (UINT64)v58;
          if( v58 )
          {
            *(_DWORD *)(p_ProcessInformation + 8) = 0;
            v60 = v58->CurrentStackIndex % v58->TableSize;
            v201 = v60;
            while( 1 )
            {
              HIDWORD(HardEnforcementFlags) = Peb;
              if( (unsigned int)Peb >= v59->TableSize )
                break;
              v61 = &v59->RefCount + 40 * v60;
              v252 = *((_OWORD *)v61 + 5);
              v253 = *((_OWORD *)v61 + 6);
              v254 = *((_OWORD *)v61 + 7);
              v255 = *((_OWORD *)v61 + 8);
              v256 = *((_OWORD *)v61 + 9);
              v257 = *((_OWORD *)v61 + 10);
              v258 = *((_OWORD *)v61 + 11);
              v259 = *((_OWORD *)v61 + 12);
              v260 = *((_OWORD *)v61 + 13);
              v261 = *((_OWORD *)v61 + 14);
              v62 = v253;
              if( *(_QWORD *)p_ProcessInformation == (_QWORD)v253 || !*(_QWORD *)p_ProcessInformation )
              {
                v63 = DWORD2(v253);
                if( DWORD2(v253) )
                {
                  ++*(_DWORD *)(p_ProcessInformation + 8);
                  if( (_DWORD)LockVariable )
                  {
                    LockVariable = (VOID *)(unsigned int)((_DWORD)LockVariable - 1);
                    v230 = (int)LockVariable;
                    *(_QWORD *)v53 = v62;
                    *(_OWORD *)(v53 + 8) = v252;
                    *(_DWORD *)(v53 + 24) = v63;
                    *(_OWORD *)(v53 + 32) = v254;
                    *(_OWORD *)(v53 + 48) = v255;
                    *(_OWORD *)(v53 + 64) = v256;
                    *(_OWORD *)(v53 + 80) = v257;
                    *(_OWORD *)(v53 + 96) = v258;
                    *(_OWORD *)(v53 + 112) = v259;
                    *(_OWORD *)(v53 + 128) = v260;
                    *(_OWORD *)(v53 + 144) = v261;
                    v53 += 160i64;
                    v250 = v53;
                  }
                  else
                  {
                    v54 = -1073741820;
                    i = -1073741820;
                  }
                }
              }
              if( !(_DWORD)v60 )
                LODWORD(v60) = v59->TableSize;
              v60 = (unsigned int)(v60 - 1);
              v201 = v60;
              LODWORD(Peb) = Peb + 1;
            }
            if( ReturnLength )
              *(_DWORD *)ReturnLength = v53 - p_ProcessInformation;
            ExDereferenceHandleDebugInfo(v57, v59);
            v64 = Process;
            ObDereferenceProcessHandleTable((_EPROCESS *)Process);
            ObfDereferenceObjectWithTag(v64, 0x79517350ui64);
            return v54;
          }
          else
          {
            ObDereferenceProcessHandleTable(v55);
            ObfDereferenceObjectWithTag(v55, 0x79517350ui64);
            return -1073741811;
          }
        }
        else
        {
          ObfDereferenceObjectWithTag(v55, 0x79517350ui64);
          return -1073741558;
        }
      }
      return result;
    case ProcessIoPriority:
      if( (_DWORD)v5 != 4 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      v38 = result;
      i = result;
      if( result < 0 )
        return result;
      v39 = Process;
      *(_DWORD *)p_ProcessInformation = (*((_DWORD *)Process + 281) >> 27) & 7;
      if( ReturnLength )
        *(_DWORD *)ReturnLength = 4;
      goto LABEL_122;
    case ProcessExecuteFlags:
      if( (_DWORD)v5 != 4 )
        return -1073741820;
      if( a1 == -1 )
      {
        CurrentProcess = (_EPROCESS *)PsGetCurrentProcess();
      }
      else
      {
        Tag[0] = 2035381072;
        result = ObReferenceObjectByHandleWithTag(
                   (VOID *)a1,
                   0x400ui64,
                   (_OBJECT_TYPE *)PsProcessType,
                   v10,
                   *(UINT64 *)Tag,
                   &Process,
                   0i64);
        if( result < 0 )
          return result;
        CurrentProcess = (_EPROCESS *)Process;
      }
      v38 = KeGetExecuteOptions(&CurrentProcess->Pcb, &ExecuteOptions);
      if( a1 != -1 )
        ObfDereferenceObjectWithTag(v66, 0x79517350ui64);
      if( v38 >= 0 )
      {
        *(_DWORD *)p_ProcessInformation = ExecuteOptions;
        if( ReturnLength )
          *(_DWORD *)ReturnLength = 4;
      }
      return v38;
    case ProcessCookie:
      CurrentTime.QuadPart = 0i64;
      if( (_DWORD)v5 != 4 )
        return -1073741820;
      if( a1 == -1 )
      {
        v67 = (_ADAPTER_OBJECT *)PsGetCurrentProcess();
        v194 = (volatile signed __int32 *)v67;
        Process = v67;
      }
      else
      {
        v220 = 0i64;
        result = ObReferenceObjectByHandle((VOID *)a1, 0x20ui64, (_OBJECT_TYPE *)PsProcessType, v10, &v220, 0i64);
        v67 = (_ADAPTER_OBJECT *)v220;
        v194 = (volatile signed __int32 *)v220;
        Process = v220;
        if( result < 0 )
          return result;
      }
      for( i = 0; ; LODWORD(Peb) = i )
      {
        ContiguousTranslations = (int)v67[2].AdapterObject.ContiguousTranslations;
        if( ContiguousTranslations )
          break;
        KeQuerySystemTimePrecise(&CurrentTime);
        CurrentPrcb = KeGetCurrentPrcb();
        PerformanceCounter = KeQueryPerformanceCounter(0i64);
        v71 = ExGenRandom(ExGenRandomDomainUserVisible);
        v72 = __rdtsc();
        _InterlockedCompareExchange(
          v194 + 330,
          v72 ^ v71 ^ CurrentPrcb->MmPageFaultCount ^ CurrentTime.anonymous_0.LowPart ^ CurrentTime.anonymous_0.HighPart ^ PerformanceCounter ^ CurrentPrcb->InterruptCount ^ CurrentPrcb->InterruptTime ^ CurrentPrcb->KeSystemCalls,
          0);
        v67 = (_ADAPTER_OBJECT *)Process;
        v194 = (volatile signed __int32 *)Process;
      }
      *(_DWORD *)p_ProcessInformation = ContiguousTranslations;
      if( ReturnLength )
        *(_DWORD *)ReturnLength = 4;
      if( a1 != -1 )
        HalPutDmaAdapter(v67);
      return Peb;
    case ProcessImageInformation:
      if( (_DWORD)v5 != 64 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      DeviceMapInformation = result;
      if( result < 0 )
        return result;
      v73 = (_EX_RUNDOWN_REF *)Process;
      if( Process == Thread->Tcb.Process )
      {
        Count = (_ADAPTER_OBJECT *)*((_QWORD *)Process + 163);
        if( !Count )
          result = -1073741558;
        DeviceMapInformation = result;
      }
      else if( ExAcquireRundownProtection((_EX_RUNDOWN_REF *)Process + 139) )
      {
        Count = (_ADAPTER_OBJECT *)v73[163].Count;
        if( Count )
          ObfReferenceObject(v73[163].Ptr);
        else
          DeviceMapInformation = -1073741811;
        ExReleaseRundownProtection(v73 + 139);
        LODWORD(Peb) = 1;
      }
      else
      {
        DeviceMapInformation = -1073741558;
        Count = 0i64;
        LODWORD(Peb) = 1;
      }
      ObfDereferenceObjectWithTag(v73, 0x79517350ui64);
      if( DeviceMapInformation >= 0 )
      {
        DeviceMapInformation = MmGetSectionInformation(Count, SectionImageInformation, (VOID *)p_ProcessInformation);
        if( (_DWORD)Peb )
          HalPutDmaAdapter(Count);
        if( DeviceMapInformation >= 0 && ReturnLength )
          *(_DWORD *)ReturnLength = 64;
      }
      return DeviceMapInformation;
    case ProcessCycleTime:
      if( (_DWORD)v5 != 16 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      v75 = result;
      if( result < 0 )
        return result;
      v76 = Process;
      LODWORD(v77) = PsQueryTotalCycleTimeProcess((INT64)Process, CycleTimeStamp);
      *(_QWORD *)p_ProcessInformation = v77;
      *(_QWORD *)(p_ProcessInformation + 8) = CycleTimeStamp[0];
      if( ReturnLength )
        *(_DWORD *)ReturnLength = 16;
      goto LABEL_644;
    case ProcessPagePriority:
      if( (_DWORD)v5 != 4 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      v38 = result;
      if( result < 0 )
        return result;
      v39 = Process;
      *(_DWORD *)p_ProcessInformation = (*((_DWORD *)Process + 280) >> 12) & 7;
      if( ReturnLength )
        *(_DWORD *)ReturnLength = 4;
      goto LABEL_122;
    case ProcessImageFileNameWin32:
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      DeviceMapInformation = result;
      if( result < 0 )
        return result;
      v16 = (_EX_RUNDOWN_REF *)Process;
      v17 = (_FILE_OBJECT *)*((_QWORD *)Process + 180);
      OutFileObject = v17;
      if( v17 )
      {
        if( ExAcquireRundownProtection((_EX_RUNDOWN_REF *)Process + 139) )
        {
          ObfReferenceObject(v17);
          ExReleaseRundownProtection(v16 + 139);
        }
        else
        {
          DeviceMapInformation = -1073741558;
        }
      }
      else
      {
        DeviceMapInformation = PsReferenceProcessFilePointer((_EPROCESS *)Process, &OutFileObject);
        v17 = (_FILE_OBJECT *)OutFileObject;
      }
      ObfDereferenceObjectWithTag(v16, 0x79517350ui64);
      if( DeviceMapInformation < 0 )
        return DeviceMapInformation;
      FileDosDeviceName = IoQueryFileDosDeviceName(v17, (_OBJECT_NAME_INFORMATION **)&P);
      HalPutDmaAdapter((PADAPTER_OBJECT)v17);
      if( FileDosDeviceName >= 0 )
      {
        v19 = (const VOID **)P;
        v20 = *((unsigned __int16 *)P + 1) + 16;
        if( v20 <= (unsigned int)v5 )
        {
          *(_WORD *)p_ProcessInformation = *(_WORD *)P;
          *(_WORD *)(p_ProcessInformation + 2) = *((_WORD *)v19 + 1);
          if( *((_WORD *)v19 + 1) )
          {
            Peb = p_ProcessInformation + 16;
            memmove((VOID *)(p_ProcessInformation + 16), v19[1], *((unsigned __int16 *)v19 + 1));
          }
          *(_QWORD *)(p_ProcessInformation + 8) = Peb;
        }
        else
        {
          FileDosDeviceName = -1073741820;
          i = -1073741820;
        }
        if( ReturnLength )
          *(_DWORD *)ReturnLength = v20;
        ExFreePoolWithTag(v19, 0);
      }
      return FileDosDeviceName;
    case ProcessImageFileMapping:
      DmaAdapter = 0i64;
      if( (_DWORD)v5 != 8 )
        return -1073741820;
      v80 = *(VOID **)p_ProcessInformation;
      v251 = *(VOID **)p_ProcessInformation;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x400ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      if( result < 0 )
        return result;
      Tag[0] = 2035381072;
      v38 = ObReferenceObjectByHandleWithTag(
              v80,
              0x100020ui64,
              (_OBJECT_TYPE *)IoFileObjectType,
              v10,
              *(UINT64 *)Tag,
              &OutFileObject,
              0i64);
      v39 = Process;
      if( v38 < 0 )
        goto LABEL_122;
      ProcessHandleInformation = PsReferenceProcessFilePointer((_EPROCESS *)Process, (VOID **)&DmaAdapter);
      ObfDereferenceObjectWithTag(Process, 0x79517350ui64);
      v82 = (_ADAPTER_OBJECT *)OutFileObject;
      if( ProcessHandleInformation < 0 )
        goto LABEL_365;
      v83 = (_HALP_DMA_TRANSLATION_BUFFER *)*((_QWORD *)OutFileObject + 5);
      v84 = DmaAdapter;
      v85 = DmaAdapter->AdapterObject.ContiguousTranslations;
      v86 = 0;
      if( v83 != v85 )
        v86 = -1073741823;
      HalPutDmaAdapter((PADAPTER_OBJECT)OutFileObject);
      HalPutDmaAdapter(v84);
      result = v86;
      if( v83 == v85 && ReturnLength )
        *(_DWORD *)ReturnLength = 0;
      return result;
    case ProcessAffinityUpdateMode:
      if( (_DWORD)v5 != 4 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      if( result < 0 )
        return result;
      HIDWORD(ExecuteOptions) = *((_DWORD *)Process + 280);
      ObfDereferenceObjectWithTag(Process, 0x79517350ui64);
      v87 = (HIDWORD(ExecuteOptions) >> 19) & 1 | 2;
      if( (ExecuteOptions & 0x4000000000000i64) == 0 )
        v87 = (HIDWORD(ExecuteOptions) >> 19) & 1;
      *(_DWORD *)p_ProcessInformation = v87;
      if( ReturnLength )
        *(_DWORD *)ReturnLength = 4;
      return 0;
    case ProcessMemoryAllocationMode:
      if( (_DWORD)v5 != 4 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      if( result < 0 )
        return result;
      HIDWORD(ExecuteOptions) = *((_DWORD *)Process + 281);
      ObfDereferenceObjectWithTag(Process, 0x79517350ui64);
      LOBYTE(Peb) = (ExecuteOptions & 0x20000000000000i64) != 0;
      *(_DWORD *)p_ProcessInformation = Peb;
      if( ReturnLength )
        *(_DWORD *)ReturnLength = 4;
      return 0;
    case ProcessGroupInformation:
      if( !ReturnLength || (v5 & 1) != 0 )
        return -1073741811;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      if( result >= 0 )
      {
        KeQueryGroupMaskProcess((_EPROCESS *)Process);
        LODWORD(GroupMask[0]) = v91;
        v93 = DataLength;
        do
        {
          _BitScanForward(&v94, v91);
          v93 += 2;
          LODWORD(DataLength) = v93;
          if( v93 <= (unsigned int)v5 )
          {
            *(_WORD *)p_ProcessInformation = v94;
            p_ProcessInformation += 2i64;
            v248 = p_ProcessInformation;
          }
          _bittestandreset((signed __int32 *)GroupMask, v94);
          v91 = GroupMask[0];
        }
        while( LODWORD(GroupMask[0]) );
        *(_DWORD *)ReturnLength = v93;
        v95 = (unsigned int)v5 < v93 ? 0xC0000023 : 0;
        i = v95;
        ObfDereferenceObjectWithTag(v92, 0x79517350ui64);
        return v95;
      }
      return result;
    case ProcessOwnerInformation:
      if( (_DWORD)v5 != 8 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      if( result < 0 )
        return result;
      v96 = *((_QWORD *)Process + 169);
      ObfDereferenceObjectWithTag(Process, 0x79517350ui64);
      *(_QWORD *)p_ProcessInformation = v96;
      if( ReturnLength )
        *(_DWORD *)ReturnLength = 8;
      return 0;
    case ProcessWindowInformation:
      memset(&v268, 0, sizeof(v268));
      v195 = 0;
      *(_OWORD *)FromAddress = 0i64;
      NumberOfBytesRead = 0i64;
      if( v10 != 1 )
        return -1073741823;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 1,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      i = result;
      if( result >= 0 )
      {
        v97 = (_EPROCESS *)Process;
        if( ExAcquireRundownProtection((_EX_RUNDOWN_REF *)Process + 139) )
        {
          KeStackAttachProcess(&v97->Pcb, &v268);
          v98 = v97->WoW64Process;
          if( v98 )
            Peb = (unsigned __int64)v98->Peb;
          if( Peb )
          {
            v232 = *(unsigned int *)(Peb + 16);
            v195 = *(_DWORD *)(v232 + 104);
            v99 = *(_QWORD *)(v232 + 112);
            CycleTimeStamp[1] = v99;
            LODWORD(FromAddress[0]) = v99;
            FromAddress[1] = (VOID *)HIDWORD(v99);
          }
          else
          {
            ProcessParameters = v97->Peb->ProcessParameters;
            p_WindowFlags = (__int64)&ProcessParameters->WindowFlags;
            if( (unsigned __int64)&ProcessParameters->WindowFlags >= 0x7FFFFFFF0000i64 )
              p_WindowFlags = 0x7FFFFFFF0000i64;
            v195 = *(_DWORD *)p_WindowFlags;
            v234 = 0i64;
            p_WindowTitle = (__int64)&ProcessParameters->WindowTitle;
            if( (unsigned __int64)&ProcessParameters->WindowTitle >= 0x7FFFFFFF0000i64 )
              p_WindowTitle = 0x7FFFFFFF0000i64;
            LODWORD(v234) = *(_DWORD *)p_WindowTitle;
            *((_QWORD *)&v234 + 1) = *(_QWORD *)(p_WindowTitle + 8);
            *(_OWORD *)FromAddress = v234;
            LOWORD(v99) = v234;
          }
          DeviceMapInformation = i;
          KeUnstackDetachProcess(&v268);
          if( DeviceMapInformation < 0 )
            goto LABEL_353;
          v102 = (unsigned __int16)v99 + 6;
          if( ReturnLength )
            *(_DWORD *)ReturnLength = v102;
          if( (unsigned int)v5 >= v102 )
          {
            *(_DWORD *)p_ProcessInformation = v195;
            *(_WORD *)(p_ProcessInformation + 4) = v99;
          }
          else
          {
            DeviceMapInformation = -1073741820;
            i = -1073741820;
          }
          if( DeviceMapInformation >= 0 && (_WORD)v99 )
          {
            v103 = (_EPROCESS *)PsGetCurrentProcess();
            *(_QWORD *)Tag = (unsigned __int16)v99;
            v35 = (_EX_RUNDOWN_REF *)Process;
            MmCopyVirtualMemory(
              (_EPROCESS *)Process,
              FromAddress[1],
              v103,
              (VOID *)(p_ProcessInformation + 6),
              *(UINT64 *)Tag,
              1,
              &NumberOfBytesRead);
            DeviceMapInformation = v104;
          }
          else
          {
LABEL_353:
            v35 = (_EX_RUNDOWN_REF *)Process;
          }
          ExReleaseRundownProtection(v35 + 139);
LABEL_355:
          ObfDereferenceObjectWithTag(v35, 0x79517350ui64);
          return DeviceMapInformation;
        }
        else
        {
LABEL_334:
          ObfDereferenceObjectWithTag(v97, 0x79517350ui64);
          return -1073741558;
        }
      }
      return result;
    case ProcessHandleInformation:
      if( (unsigned int)v5 < 0x10 )
      {
        if( ReturnLength )
          *(_DWORD *)ReturnLength = 16;
        return -1073741820;
      }
      v216 = 0i64;
      result = ObReferenceObjectByHandle((VOID *)a1, 0x400ui64, (_OBJECT_TYPE *)PsProcessType, v10, &v216, 0i64);
      if( result >= 0 )
      {
        KeEnterCriticalRegionThread(&Thread->Tcb);
        v105 = (_EPROCESS *)v216;
        v106 = ObReferenceProcessHandleTable((_EPROCESS *)v216);
        if( v106 )
        {
          ProcessHandleInformation = ExQueryProcessHandleInformation(
                                       v106,
                                       (PROCESS_HANDLE_SNAPSHOT_INFORMATION *)p_ProcessInformation,
                                       (unsigned int)v5,
                                       ReturnLength);
          ObDereferenceProcessHandleTable(v105);
        }
        else
        {
          ProcessHandleInformation = -1073741558;
        }
        KeLeaveCriticalRegionThread(&Thread->Tcb);
        v82 = (_ADAPTER_OBJECT *)v105;
LABEL_365:
        HalPutDmaAdapter(v82);
        return ProcessHandleInformation;
      }
      return result;
    case ProcessMitigationPolicy:
      SignaturePolicy.Flags = 0;
      HandleExceptionsOn = 0;
      HandleExceptionsPermanent = 0;
      if( (_DWORD)v5 != 8 )
        return -1073741820;
      v107 = *(_DWORD *)p_ProcessInformation;
      v235 = *(_DWORD *)p_ProcessInformation;
      if( a1 == -1 )
      {
        Process = PsGetCurrentProcess();
      }
      else
      {
        Tag[0] = 2035381072;
        result = ObReferenceObjectByHandleWithTag(
                   (VOID *)a1,
                   0x1000ui64,
                   (_OBJECT_TYPE *)PsProcessType,
                   v10,
                   *(UINT64 *)Tag,
                   &Process,
                   0i64);
        if( result < 0 )
          return result;
      }
      break;
    case ProcessHandleCheckingMode:
      if( (_DWORD)v5 != 4 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x400ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      v141 = result;
      i = result;
      if( result < 0 )
        return result;
      v97 = (_EPROCESS *)Process;
      v142 = ObReferenceProcessHandleTable((_EPROCESS *)Process);
      if( !v142 )
        goto LABEL_334;
      LOBYTE(Peb) = ExQueryHandleExceptions(v142) != 0;
      *(_DWORD *)p_ProcessInformation = Peb;
      goto LABEL_512;
    case ProcessKeepAliveCount:
      if( (_DWORD)v5 != 8 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x400ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      v38 = result;
      if( result < 0 )
        return result;
      *(_DWORD *)p_ProcessInformation = PsGetKeepAliveCountProcess((_EPROCESS *)Process, 1u);
      *(_DWORD *)(p_ProcessInformation + 4) = PsGetKeepAliveCountProcess(v143, 0);
      goto LABEL_122;
    case ProcessHandleTable:
      LockedBuffer = 0i64;
      LockVariable = 0i64;
      if( (unsigned int)v5 < 4 )
        return -1073741820;
      result = ExLockUserBuffer(
                 (VOID *)p_ProcessInformation,
                 (unsigned int)v5,
                 KeGetCurrentThread()->PreviousMode,
                 IoWriteAccess,
                 &LockedBuffer,
                 &LockVariable);
      if( result >= 0 )
      {
        Tag[0] = 2035381072;
        v144 = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x440ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
        if( v144 >= 0 )
        {
          v221[0] = 0i64;
          v145 = (_EPROCESS *)Process;
          v146 = ObReferenceProcessHandleTable((_EPROCESS *)Process);
          if( v146 )
          {
            *(_QWORD *)&v221[0] = LockedBuffer;
            *((_QWORD *)&v221[0] + 1) = (unsigned int)v5 >> 2;
            ExEnumHandleTable(
              v146,
              (__int64(__fastcall *)(_HANDLE_TABLE *, _HANDLE_TABLE_ENTRY *, _EXHANDLE, __int64))PspHandleTableWalker,
              (__int64)v221,
              0i64);
            ObDereferenceProcessHandleTable(v145);
          }
          else
          {
            LODWORD(Peb) = -1073741558;
          }
          ObfDereferenceObjectWithTag(v145, 0x79517350ui64);
          if( ReturnLength )
            *(_DWORD *)ReturnLength = 4 * HIDWORD(v221[0]);
          ExUnlockUserBuffer(LockVariable);
          return Peb;
        }
        else
        {
          ExUnlockUserBuffer(LockVariable);
          return v144;
        }
      }
      return result;
    case ProcessCheckStackExtentsMode:
      if( (_DWORD)v5 != 4 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x400ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      v38 = result;
      if( result < 0 )
        return result;
      v39 = Process;
      *(_DWORD *)p_ProcessInformation = (*((_DWORD *)Process + 158) >> 5) & 1;
      goto LABEL_122;
    case ProcessCommandLineInformation:
      Tag[0] = 2035381072;
      DeviceMapInformation = ObReferenceObjectByHandleWithTag(
                               (VOID *)a1,
                               0x1000ui64,
                               (_OBJECT_TYPE *)PsProcessType,
                               v10,
                               *(UINT64 *)Tag,
                               &Process,
                               0i64);
      if( DeviceMapInformation < 0 )
        return DeviceMapInformation;
      v147 = v10;
      v148 = Process;
      ProcessCommandLine = PsQueryProcessCommandLine(
                             Process,
                             (_UNICODE_STRING *)p_ProcessInformation,
                             (unsigned int)v5,
                             v147,
                             (INT64)ReturnLength);
      goto LABEL_529;
    case ProcessProtectionInformation:
      Tag[0] = 2035381072;
      FileDosDeviceName = ObReferenceObjectByHandleWithTag(
                            (VOID *)a1,
                            0x1000ui64,
                            (_OBJECT_TYPE *)PsProcessType,
                            v10,
                            *(UINT64 *)Tag,
                            &Process,
                            0i64);
      if( FileDosDeviceName < 0 )
        return FileDosDeviceName;
      if( (_DWORD)v5 )
      {
        v22 = (_EPROCESS *)Process;
        *(_PS_PROTECTION *)p_ProcessInformation = PsGetProcessProtection((_EPROCESS *)Process);
        if( ReturnLength )
          *(_DWORD *)ReturnLength = 1;
        FileDosDeviceName = 0;
      }
      else
      {
        FileDosDeviceName = -1073741820;
        v22 = (_EPROCESS *)Process;
      }
      if( !v22 )
        return FileDosDeviceName;
LABEL_538:
      ObfDereferenceObjectWithTag(v22, 0x79517350ui64);
      return FileDosDeviceName;
    case ProcessTelemetryIdInformation:
      Tag[0] = 2035381072;
      DeviceMapInformation = ObReferenceObjectByHandleWithTag(
                               (VOID *)a1,
                               0x1000ui64,
                               (_OBJECT_TYPE *)PsProcessType,
                               v10,
                               *(UINT64 *)Tag,
                               &Process,
                               0i64);
      if( DeviceMapInformation < 0 )
        return DeviceMapInformation;
      v150 = v10;
      v148 = Process;
      ProcessCommandLine = EtwQueryProcessTelemetryInfo(
                             (_EPROCESS *)Process,
                             (VOID *)p_ProcessInformation,
                             (unsigned int)v5,
                             v150,
                             (INT64)ReturnLength);
LABEL_529:
      DeviceMapInformation = ProcessCommandLine;
      if( v148 )
        goto LABEL_530;
      return DeviceMapInformation;
    case ProcessCommitReleaseInformation:
      LODWORD(EligibleOut) = 0;
      if( (_DWORD)v5 == 32 )
      {
        *(_OWORD *)CommitDebtOut = *(_OWORD *)p_ProcessInformation;
        *(_OWORD *)MemResetCommittedPagesOut = *(_OWORD *)(p_ProcessInformation + 16);
        if( LODWORD(CommitDebtOut[0]) == 3 )
        {
          if( HIDWORD(CommitDebtOut[0]) >= 8 || CommitDebtOut[1] )
          {
            FileDosDeviceName = -1073741811;
          }
          else
          {
            Tag[0] = 2035381072;
            FileDosDeviceName = ObReferenceObjectByHandleWithTag(
                                  (VOID *)a1,
                                  0x1000ui64,
                                  (_OBJECT_TYPE *)PsProcessType,
                                  v10,
                                  *(UINT64 *)Tag,
                                  &Process,
                                  0i64);
            if( FileDosDeviceName >= 0 )
            {
              MmQueryCommitReleaseState(
                (_EPROCESS *)Process,
                &EligibleOut,
                &CommitDebtOut[1],
                MemResetCommittedPagesOut,
                &MemResetCommittedPagesOut[1]);
              HIDWORD(CommitDebtOut[0]) ^= ((unsigned __int8)EligibleOut ^ BYTE4(CommitDebtOut[0])) & 1;
              CommitDebtOut[1] <<= 12;
              MemResetCommittedPagesOut[0] <<= 12;
              MemResetCommittedPagesOut[1] <<= 12;
              *(_OWORD *)p_ProcessInformation = *(_OWORD *)CommitDebtOut;
              *(_OWORD *)(p_ProcessInformation + 16) = *(_OWORD *)MemResetCommittedPagesOut;
              FileDosDeviceName = 0;
            }
          }
        }
        else
        {
          FileDosDeviceName = -1073741735;
        }
      }
      else
      {
        FileDosDeviceName = -1073741820;
      }
      v23 = Process;
      if( Process )
        goto LABEL_554;
      return FileDosDeviceName;
    case ProcessDefaultCpuSetsInformation:
    case ProcessAllowedCpuSetsInformation:
      if( (v5 & 7) != 0 || (unsigned int)v5 > 0xA0 )
        return -1073741820;
      Tag[0] = 2035381072;
      FileDosDeviceName = ObReferenceObjectByHandleWithTag(
                            (VOID *)a1,
                            0x1000ui64,
                            (_OBJECT_TYPE *)PsProcessType,
                            v10,
                            *(UINT64 *)Tag,
                            &Process,
                            0i64);
      if( FileDosDeviceName >= 0 )
      {
        LOBYTE(Peb) = v7 == ProcessAllowedCpuSetsInformation;
        v153 = 8 * KeQueryCpuSetsProcess((_KPROCESS *)Process, CpuSets, v152, (unsigned int)Peb);
        ObfDereferenceObjectWithTag(Process, 0x79517350ui64);
        if( ReturnLength )
          *(_DWORD *)ReturnLength = v153;
        if( v153 < (unsigned int)v5 )
          LODWORD(v5) = v153;
        memmove((VOID *)p_ProcessInformation, CpuSets, v5);
      }
      return FileDosDeviceName;
    case ProcessJobMemoryInformation:
      if( (_DWORD)v5 != 40 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      if( result >= 0 )
      {
        *((_QWORD *)&v221[2] + 1) = 0i64;
        v222 = 0i64;
        if( *((_QWORD *)Process + 162) )
        {
          KeStackAttachProcess((PRKPROCESS)Process, &ApcState);
          ZwQueryInformationJobObject(0i64, JobObjectMemoryUsageInformation, &JobObjectInformation, 0x28ui64, 0i64);
          ZwQueryInformationJobObject(0i64, JobObjectExtendedLimitInformation, v269, 0x98ui64, 0i64);
          KeUnstackDetachProcess(&ApcState);
          *(__int128 *)((char *)&v221[1] + 8) = JobObjectInformation;
          *(_QWORD *)&v221[1] = v265;
          v78 = v222;
          if( (v270 & 0x200000) != 0 )
            v78 = v278;
          v222 = v78;
          v79 = *((_QWORD *)&v221[2] + 1);
          if( (v270 & 0x200) != 0 )
            v79 = *((_QWORD *)&v276 + 1);
          *((_QWORD *)&v221[2] + 1) = v79;
          *(__m256i *)p_ProcessInformation = *(__m256i *)&v221[1];
          *(_QWORD *)(p_ProcessInformation + 32) = v222;
          if( ReturnLength )
            *(_DWORD *)ReturnLength = 40;
        }
        else
        {
          LODWORD(Peb) = -1073741394;
        }
        ObfDereferenceObjectWithTag(Process, 0x79517350ui64);
        return Peb;
      }
      return result;
    case ProcessInPrivate:
      if( (_DWORD)v5 != 1 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      v38 = result;
      if( result < 0 )
        return result;
      v39 = Process;
      *(_BYTE *)p_ProcessInformation = *((int *)Process + 280) < 0;
      goto LABEL_122;
    case ProcessRaiseUMExceptionOnInvalidHandleClose:
      if( (_DWORD)v5 != 4 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      v141 = result;
      i = result;
      if( result < 0 )
        return result;
      v97 = (_EPROCESS *)Process;
      v151 = ObReferenceProcessHandleTable((_EPROCESS *)Process);
      if( !v151 )
        goto LABEL_334;
      LOBYTE(Peb) = ExQueryRaiseUMExceptionOnInvalidHandleClose(v151) != 0;
      *(_DWORD *)p_ProcessInformation = Peb;
LABEL_512:
      ObDereferenceProcessHandleTable(v97);
      ObfDereferenceObjectWithTag(v97, 0x79517350ui64);
      return v141;
    case ProcessIumChallengeResponse:
      return PsIumGetOnDemandDebugChallenge((VOID *)a1, (VOID *)p_ProcessInformation, v5, ReturnLength);
    case ProcessChildProcessInformation:
      if( (_DWORD)v5 != 3 )
        return -1073741820;
      if( a1 == -1 )
      {
        v154 = (_EPROCESS *)PsGetCurrentProcess();
        Process = v154;
      }
      else
      {
        Tag[0] = 2035381072;
        result = ObReferenceObjectByHandleWithTag(
                   (VOID *)a1,
                   0x400ui64,
                   (_OBJECT_TYPE *)PsProcessType,
                   v10,
                   *(UINT64 *)Tag,
                   &Process,
                   0i64);
        if( result < 0 )
          return result;
        v154 = (_EPROCESS *)Process;
      }
      NoChildProcessRestrictedPolicy = PspGetNoChildProcessRestrictedPolicy(v154);
      *(_WORD *)p_ProcessInformation = 0;
      *(_BYTE *)(p_ProcessInformation + 2) = 0;
      v156 = NoChildProcessRestrictedPolicy - 1;
      if( !v156 )
        goto LABEL_581;
      v157 = v156 - 1;
      if( v157 )
      {
        if( v157 == 1 )
          *(_BYTE *)(p_ProcessInformation + 2) = 1;
      }
      else
      {
        *(_BYTE *)(p_ProcessInformation + 1) = 1;
LABEL_581:
        *(_BYTE *)p_ProcessInformation = 1;
      }
      if( ReturnLength )
        *(_DWORD *)ReturnLength = 3;
      if( a1 == -1 )
        return Peb;
LABEL_585:
      ObfDereferenceObjectWithTag(v154, 0x79517350ui64);
      return 0;
    case ProcessHighGraphicsPriorityInformation:
      if( (_DWORD)v5 != 1 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      v38 = result;
      if( result < 0 )
        return result;
      v39 = Process;
      *(_BYTE *)p_ProcessInformation = (*((_DWORD *)Process + 543) & 0x200) != 0;
      goto LABEL_122;
    case MaxProcessInfoClass:
      if( (_DWORD)v5 != 4 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      v38 = result;
      if( result < 0 )
        return result;
      v39 = Process;
      if( *((_QWORD *)Process + 280) )
        LODWORD(Peb) = qword_140C1DE90;
      *(_DWORD *)p_ProcessInformation = Peb;
      if( ReturnLength )
        *(_DWORD *)ReturnLength = 4;
      goto LABEL_122;
    case ProcessIumChallengeResponse|ProcessTimes:
      memset(EnergyValues, 0i64, sizeof(EnergyValues));
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      v75 = result;
      if( result < 0 )
        return result;
      v76 = Process;
      PsQueryProcessEnergyValues((_EPROCESS *)Process, (_PROCESS_ENERGY_VALUES *)EnergyValues);
      if( (unsigned int)v5 > 0x1B0 )
        LODWORD(v5) = 432;
      memmove((VOID *)p_ProcessInformation, EnergyValues, v5);
      if( ReturnLength )
        *(_DWORD *)ReturnLength = 432;
      goto LABEL_644;
    case ProcessChildProcessInformation|ProcessTimes:
      v262 = 0i64;
      v263 = 0;
      if( (_DWORD)v5 != 12 )
        return -1073741820;
      ExtensionTable = ExGetExtensionTable((_EX_HOST *)PspBamExtensionHost);
      if( !ExtensionTable )
        return -1073741822;
      Tag[0] = 2035381072;
      v159 = ObReferenceObjectByHandleWithTag(
               (VOID *)a1,
               0x1000ui64,
               (_OBJECT_TYPE *)PsProcessType,
               v10,
               *(UINT64 *)Tag,
               &Process,
               0i64);
      if( v159 >= 0 )
      {
        v160 = (__int64(__fastcall *)(_QWORD, _QWORD))ExtensionTable[2];
        v161 = Process;
        v159 = v160(Process, &v262);
        if( v159 >= 0 )
        {
          *(_QWORD *)p_ProcessInformation = v262;
          *(_DWORD *)(p_ProcessInformation + 8) = v263;
          if( ReturnLength )
            *(_DWORD *)ReturnLength = 12;
          v159 = 0;
          i = 0;
        }
        ObfDereferenceObjectWithTag(v161, 0x79517350ui64);
      }
      ExReleaseExtensionTable(PspBamExtensionHost);
      return v159;
    case MaxProcessInfoClass|ProcessTimes:
      if( (_DWORD)v5 != 8 )
        return -1073741820;
      if( a1 == -1 )
      {
        v162 = PsGetCurrentProcess();
        Process = v162;
      }
      else
      {
        Tag[0] = 2035381072;
        result = ObReferenceObjectByHandleWithTag(
                   (VOID *)a1,
                   0x400ui64,
                   (_OBJECT_TYPE *)PsProcessType,
                   v10,
                   *(UINT64 *)Tag,
                   &Process,
                   0i64);
        if( result < 0 )
          return result;
        v162 = Process;
      }
      *(_DWORD *)p_ProcessInformation = 0;
      v163 = v162[628];
      v164 = 0;
      if( (v163 & 0x4000) != 0 )
      {
        v164 = 1;
        *(_DWORD *)p_ProcessInformation = 1;
        v163 = v162[628];
      }
      if( (v163 & 0x8000) != 0 )
        *(_DWORD *)p_ProcessInformation = v164 | 2;
      *(_DWORD *)(p_ProcessInformation + 4) = v162[602];
      if( ReturnLength )
        *(_DWORD *)ReturnLength = 8;
      if( a1 != -1 )
        goto LABEL_624;
      return Peb;
    case ProcessCommitReleaseInformation|ProcessUserModeIOPL:
      if( v10 )
        return -1073741790;
      if( (_DWORD)v5 != 48 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 0,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      if( result >= 0 )
      {
        v148 = Process;
        PspAllocateAndQueryProcessNotificationChannel(Thread, (INT64)Process, p_ProcessInformation);
        DeviceMapInformation = v165;
        if( v165 >= 0 && ReturnLength )
        {
          *(_DWORD *)ReturnLength = 48;
          ObfDereferenceObjectWithTag(v148, 0x79517350ui64);
          return DeviceMapInformation;
        }
        else
        {
LABEL_530:
          ObfDereferenceObjectWithTag(v148, 0x79517350ui64);
          return DeviceMapInformation;
        }
      }
      return result;
    case ProcessReserved1Information|ProcessUserModeIOPL:
      *(_OWORD *)v279 = 0i64;
      v280 = 0i64;
      v281 = 0i64;
      v282 = 0i64;
      v283 = 0i64;
      v284 = 0i64;
      v285 = 0i64;
      v286 = 0i64;
      v287 = 0i64;
      if( (unsigned int)v5 < 8 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      if( result >= 0 )
      {
        v166 = Process;
        PoQueryProcessEnergyTrackingState((INT64)Process, (INT64)v279);
        v167 = 144;
        if( (unsigned int)v5 < 0x90 )
          v167 = v5;
        memmove((VOID *)p_ProcessInformation, v279, v167);
        if( ReturnLength )
          *(_DWORD *)ReturnLength = v167;
        i = 0;
        ObfDereferenceObjectWithTag(v166, 0x79517350ui64);
        return 0;
      }
      return result;
    case ProcessSubsystemProcess|ProcessUserModeIOPL:
      if( (_DWORD)v5 != 4 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x418ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      if( result < 0 )
        return result;
      v76 = Process;
      if( *((_QWORD *)Process + 124) )
      {
        v75 = VslLiveDumpCaptureProcess((__int64)Process);
LABEL_644:
        ObfDereferenceObjectWithTag(v76, 0x79517350ui64);
        return v75;
      }
      else
      {
        ObfDereferenceObjectWithTag(Process, 0x79517350ui64);
        return -1073741790;
      }
    case ProcessJobMemoryInformation|ProcessUserModeIOPL:
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      if( result < 0 )
        return result;
      LOBYTE(v45) = EtwQueryProcessTelemetryCoverage((_ERESOURCE *)Process, p_ProcessInformation);
LABEL_150:
      v46 = v45;
      ObfDereferenceObjectWithTag(Process, 0x79517350ui64);
      return v46;
    case ProcessRaiseUMExceptionOnInvalidHandleClose|ProcessUserModeIOPL:
    case ProcessTelemetryIdInformation|ProcessHandleTracing:
      if( v7 == (ProcessRaiseUMExceptionOnInvalidHandleClose|ProcessUserModeIOPL) && !(_DWORD)v5
        || v7 == (ProcessTelemetryIdInformation|ProcessHandleTracing) && (unsigned int)v5 < 4 )
      {
        return -1073741820;
      }
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      v38 = result;
      if( result < 0 )
        return result;
      v39 = Process;
      *(_BYTE *)p_ProcessInformation = HIBYTE(*((_DWORD *)Process + 280)) & 3;
      if( v7 == (ProcessTelemetryIdInformation|ProcessHandleTracing) )
        *(_DWORD *)p_ProcessInformation |= (v39[543] >> 17) & 0xC;
      goto LABEL_122;
    case ProcessIumChallengeResponse|ProcessUserModeIOPL:
      memset(&DeepFreezeStats, 0, sizeof(DeepFreezeStats));
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      if( result < 0 )
        return result;
      LastAppStateUpdateTime = 0i64;
      v170 = 0i64;
      v225 = 0i64;
      v204 = 0i64;
      v226 = 0i64;
      v228 = 0i64;
      v171 = Thread;
      v154 = (_EPROCESS *)Process;
      PspLockProcessSecurityShared((PEPROCESS)Process, Thread);
      v172 = (unsigned __int64)v154->_bf_920 >> 61;
      if( v172 - 3 <= 1
        && (v204 = (VOID *)(v154->_bf_920 & 0x1FFFFFFFFFFFFFFFi64),
            v226 = v204,
            LastAppStateUpdateTime = v154->LastAppStateUpdateTime,
            v170 = LastAppStateUpdateTime - v154->CreateInterruptTime,
            v225 = v170,
            v172 == 3) )
      {
        v173 = 512;
      }
      else
      {
        v173 = v228;
      }
      LODWORD(v228) = v173 & 0xFFFFFE00 | v154->_bf_87b & 7 | (2 * (v154->_bf_87b & 0x38 | (32 * (v154->Flags3 & 4))));
      PspUnlockProcessShared(v154, v171);
      PsGetProcessDeepFreezeStats(v154, &DeepFreezeStats);
      v223[0] = DeepFreezeStats.CurrentTime;
      v223[1] = DeepFreezeStats.CurrentUnbiasedTime;
      TotalFrozenUnbiasedTime = DeepFreezeStats.TotalFrozenUnbiasedTime;
      if( !v170 )
        v225 = DeepFreezeStats.CurrentTime - v154->CreateInterruptTime;
      if( !v204 )
        v226 = (VOID *)(DeepFreezeStats.CurrentUnbiasedTime
                      - v154->CreateUnbiasedInterruptTime
                      - DeepFreezeStats.TotalFrozenUnbiasedTime);
      v174 = 56;
      if( (unsigned int)v5 < 0x38 )
        v174 = v5;
      memmove((VOID *)p_ProcessInformation, v223, v174);
      if( ReturnLength )
        *(_DWORD *)ReturnLength = v174;
      i = 0;
      goto LABEL_585;
    case ProcessChildProcessInformation|ProcessUserModeIOPL:
      v204 = 0i64;
      if( (_DWORD)v5 != 8 )
        return -1073741820;
      if( v10 )
      {
        v168 = p_ProcessInformation;
        if( p_ProcessInformation >= 0x7FFFFFFF0000i64 )
          v168 = 0x7FFFFFFF0000i64;
        *(_QWORD *)v168 = *(_QWORD *)v168;
      }
      v169 = (_EPROCESS *)PsGetCurrentProcess();
      if( a1 != -1 || v169 != Thread->Tcb.Process )
        return -1073741790;
      LOBYTE(Object) = v10;
      result = ObOpenObjectByPointer(
                 v169->SectionObject,
                 0i64,
                 0i64,
                 5,
                 MmSectionObjectType,
                 (_KPROCESSOR_MODE)Object,
                 &v204);
      if( result >= 0 )
      {
        *(_QWORD *)p_ProcessInformation = v204;
        if( ReturnLength )
          *(_DWORD *)ReturnLength = 8;
      }
      return result;
    case ProcessIumChallengeResponse|ProcessHandleCount:
      if( (_DWORD)v5 != 8 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      v38 = result;
      if( result < 0 )
        return result;
      v39 = Process;
      *(_QWORD *)p_ProcessInformation = *((_QWORD *)Process + 287);
      if( ReturnLength )
        *(_DWORD *)ReturnLength = 8;
LABEL_122:
      ObfDereferenceObjectWithTag(v39, 0x79517350ui64);
      return v38;
    case ProcessHighGraphicsPriorityInformation|ProcessHandleCount:
      if( (_DWORD)v5 != 8 )
        return -1073741820;
      Tag[0] = 2035381072;
      result = ObReferenceObjectByHandleWithTag(
                 (VOID *)a1,
                 0x1000ui64,
                 (_OBJECT_TYPE *)PsProcessType,
                 v10,
                 *(UINT64 *)Tag,
                 &Process,
                 0i64);
      i = result;
      if( result < 0 )
        return result;
      if( (*((_DWORD *)Process + 280) & 0x8000) != 0 )
      {
        _InterlockedOr(&v181, 0);
        LODWORD(v175) = PspReadProcessSecurityDomain((INT64)Process);
        *(_QWORD *)p_ProcessInformation = v175;
        if( ReturnLength )
          *(_DWORD *)ReturnLength = 8;
        i = 0;
LABEL_624:
        ObfDereferenceObjectWithTag(v162, 0x79517350ui64);
        return 0;
      }
      else
      {
        ObfDereferenceObjectWithTag(Process, 0x79517350ui64);
        return -1073741700;
      }
    case ProcessCommitReleaseInformation|ProcessHandleTracing:
      if( (_DWORD)v5 == 8 )
      {
        if( a1 == -1 )
        {
          v176 = (_EPROCESS *)PsGetCurrentProcess();
          v177 = v176->Peb;
          if( v177 )
          {
            v178 = 0i64;
            v179 = v176->WoW64Process;
            if( v179 )
              v178 = v179->Peb;
            if( v178 )
            {
              if( (v178[285] & 1) != 0 )
                LODWORD(v205) = 1;
            }
            else
            {
              v180 = v205;
              if( (v177->LeapSecondFlags & 1) != 0 )
                v180 = 1;
              LODWORD(v205) = v180;
            }
          }
          *(_QWORD *)p_ProcessInformation = v205;
          if( ReturnLength )
            *(_DWORD *)ReturnLength = 8;
          return Peb;
        }
        else
        {
          return -1073741811;
        }
      }
      else
      {
        if( ReturnLength )
          *(_DWORD *)ReturnLength = 8;
        return -1073741820;
      }
    default:
      return -1073741821;
  }
  switch( v107 )
  {
    case 1:
      i = 0;
      *(_DWORD *)(p_ProcessInformation + 4) = 0;
      v108 = Process;
      v109 = *((_DWORD *)Process + 628);
      if( (v109 & 0x40) == 0 )
      {
        *(_DWORD *)(p_ProcessInformation + 4) |= 1u;
        v109 = v108[628];
      }
      if( (v109 & 0x10) != 0 )
      {
        *(_DWORD *)(p_ProcessInformation + 4) |= 2u;
        v109 = v108[628];
      }
      if( (v109 & 0x20) != 0 )
      {
        *(_DWORD *)(p_ProcessInformation + 4) |= 4u;
        v109 = v108[628];
      }
      if( (v109 & 8) != 0 )
        *(_DWORD *)(p_ProcessInformation + 4) |= 8u;
      goto LABEL_505;
    case 2:
      i = 0;
      *(_DWORD *)(p_ProcessInformation + 4) = 0;
      v113 = Process;
      v114 = *((_DWORD *)Process + 628);
      if( (v114 & 0x100) != 0 )
      {
        v115 = *(_DWORD *)(p_ProcessInformation + 4) | 1;
      }
      else
      {
        if( (v114 & 0x800) == 0 )
          goto LABEL_399;
        v115 = *(_DWORD *)(p_ProcessInformation + 4) | 8;
      }
      *(_DWORD *)(p_ProcessInformation + 4) = v115;
LABEL_399:
      v116 = v113[628];
      if( (v116 & 0x200) != 0 )
      {
        *(_DWORD *)(p_ProcessInformation + 4) |= 2u;
        v116 = v113[628];
      }
      if( (v116 & 0x400) != 0 )
        *(_DWORD *)(p_ProcessInformation + 4) |= 4u;
      goto LABEL_505;
    case 3:
      i = 0;
      v110 = ObReferenceProcessHandleTable((_EPROCESS *)Process);
      if( v110 )
      {
        ExQueryHandleExceptionsPermanency(v110, &HandleExceptionsOn, &HandleExceptionsPermanent);
        *(_DWORD *)(p_ProcessInformation + 4) = 0;
        if( HandleExceptionsOn )
          *(_DWORD *)(p_ProcessInformation + 4) |= 1u;
        if( HandleExceptionsPermanent )
          *(_DWORD *)(p_ProcessInformation + 4) |= 2u;
        ObDereferenceProcessHandleTable((_EPROCESS *)Process);
      }
      else
      {
        i = -1073741558;
      }
      goto LABEL_505;
    case 4:
      i = 0;
      *(_DWORD *)(p_ProcessInformation + 4) = 0;
      v111 = *((_DWORD *)Process + 628);
      if( (v111 & 0x1000) != 0 )
      {
        v112 = *(_DWORD *)(p_ProcessInformation + 4) | 1;
      }
      else
      {
        if( (v111 & 0x2000) == 0 )
          goto LABEL_505;
        v112 = *(_DWORD *)(p_ProcessInformation + 4) | 2;
      }
      *(_DWORD *)(p_ProcessInformation + 4) = v112;
      goto LABEL_505;
    case 6:
      i = 0;
      *(_DWORD *)(p_ProcessInformation + 4) = 0;
      if( (*((_DWORD *)Process + 628) & 0x80u) != 0 )
        *(_DWORD *)(p_ProcessInformation + 4) |= 1u;
      goto LABEL_505;
    case 7:
      i = 0;
      *(_DWORD *)(p_ProcessInformation + 4) = 0;
      v117 = Process;
      v118 = *((_DWORD *)Process + 628);
      if( (v118 & 1) != 0 )
      {
        *(_DWORD *)(p_ProcessInformation + 4) |= 1u;
        v118 = v117[628];
      }
      if( (v118 & 2) != 0 )
      {
        *(_DWORD *)(p_ProcessInformation + 4) |= 2u;
        v118 = v117[628];
      }
      if( (v118 & 4) != 0 )
        *(_DWORD *)(p_ProcessInformation + 4) |= 4u;
      goto LABEL_505;
    case 8:
      i = 0;
      PsQueryProcessSignatureMitigationPolicy((_EPROCESS *)Process, &SignaturePolicy);
      *(_PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY *)(p_ProcessInformation + 4) = SignaturePolicy;
      goto LABEL_505;
    case 9:
      i = 0;
      *(_DWORD *)(p_ProcessInformation + 4) = 0;
      v119 = *((_DWORD *)Process + 628);
      if( (v119 & 0x10000) != 0 )
      {
        v120 = *(_DWORD *)(p_ProcessInformation + 4) | 1;
      }
      else
      {
        if( (v119 & 0x20000) == 0 )
          goto LABEL_505;
        v120 = *(_DWORD *)(p_ProcessInformation + 4) | 2;
      }
      *(_DWORD *)(p_ProcessInformation + 4) = v120;
      goto LABEL_505;
    case 10:
      i = 0;
      *(_DWORD *)(p_ProcessInformation + 4) = 0;
      v121 = Process;
      v122 = *((_DWORD *)Process + 628);
      if( (v122 & 0x80000) != 0 )
      {
        v123 = *(_DWORD *)(p_ProcessInformation + 4) | 1;
      }
      else
      {
        if( (v122 & 0x100000) == 0 )
          goto LABEL_426;
        v123 = *(_DWORD *)(p_ProcessInformation + 4) | 8;
      }
      *(_DWORD *)(p_ProcessInformation + 4) = v123;
LABEL_426:
      v124 = v121[628];
      if( (v124 & 0x200000) != 0 )
      {
        v125 = *(_DWORD *)(p_ProcessInformation + 4) | 2;
      }
      else
      {
        if( (v124 & 0x400000) == 0 )
          goto LABEL_431;
        v125 = *(_DWORD *)(p_ProcessInformation + 4) | 0x10;
      }
      *(_DWORD *)(p_ProcessInformation + 4) = v125;
LABEL_431:
      if( (v121[628] & 0x40000) != 0 )
        *(_DWORD *)(p_ProcessInformation + 4) |= 4u;
      goto LABEL_505;
    case 11:
      i = 0;
      *(_DWORD *)(p_ProcessInformation + 4) = 0;
      *(_DWORD *)(p_ProcessInformation + 4) = PsGetWin32KFilterSet() & 0xF | *(_DWORD *)(p_ProcessInformation + 4) & 0xFFFFFFF0;
      goto LABEL_505;
    case 12:
      i = 0;
      *(_DWORD *)(p_ProcessInformation + 4) = 0;
      v126 = Process;
      v127 = *((_DWORD *)Process + 629);
      if( (v127 & 1) != 0 )
      {
        *(_DWORD *)(p_ProcessInformation + 4) |= 1u;
        v127 = v126[629];
      }
      if( (v127 & 4) != 0 )
      {
        *(_DWORD *)(p_ProcessInformation + 4) |= 4u;
        v127 = v126[629];
      }
      if( (v127 & 0x400) != 0 )
      {
        *(_DWORD *)(p_ProcessInformation + 4) |= 0x10u;
        v127 = v126[629];
      }
      if( (v127 & 0x10) != 0 )
      {
        *(_DWORD *)(p_ProcessInformation + 4) |= 0x40u;
        v127 = v126[629];
      }
      if( (v127 & 0x40) != 0 )
      {
        *(_DWORD *)(p_ProcessInformation + 4) |= 0x100u;
        v127 = v126[629];
      }
      if( (v127 & 0x100) != 0 )
      {
        *(_DWORD *)(p_ProcessInformation + 4) |= 0x400u;
        v127 = v126[629];
      }
      if( (v127 & 2) != 0 )
      {
        *(_DWORD *)(p_ProcessInformation + 4) |= 2u;
        v127 = v126[629];
      }
      if( (v127 & 8) != 0 )
      {
        *(_DWORD *)(p_ProcessInformation + 4) |= 8u;
        v127 = v126[629];
      }
      if( (v127 & 0x800) != 0 )
      {
        *(_DWORD *)(p_ProcessInformation + 4) |= 0x20u;
        v127 = v126[629];
      }
      if( (v127 & 0x20) != 0 )
      {
        *(_DWORD *)(p_ProcessInformation + 4) |= 0x80u;
        v127 = v126[629];
      }
      if( (v127 & 0x80u) != 0 )
      {
        *(_DWORD *)(p_ProcessInformation + 4) |= 0x200u;
        v127 = v126[629];
      }
      if( (v127 & 0x200) != 0 )
        *(_DWORD *)(p_ProcessInformation + 4) |= 0x800u;
      goto LABEL_505;
    case 13:
      i = 0;
      v128 = PspGetNoChildProcessRestrictedPolicy((_EPROCESS *)Process);
      *(_DWORD *)(p_ProcessInformation + 4) = 0;
      v129 = v128 - 1;
      if( !v129 )
        goto LABEL_465;
      v130 = v129 - 1;
      if( v130 )
      {
        if( v130 != 1 )
          goto LABEL_505;
        v131 = *(_DWORD *)(p_ProcessInformation + 4) | 2;
      }
      else
      {
        *(_DWORD *)(p_ProcessInformation + 4) |= 4u;
LABEL_465:
        v131 = *(_DWORD *)(p_ProcessInformation + 4) | 1;
      }
      *(_DWORD *)(p_ProcessInformation + 4) = v131;
      goto LABEL_505;
    case 14:
      i = 0;
      *(_DWORD *)(p_ProcessInformation + 4) = 0;
      v135 = Process;
      v136 = *((_DWORD *)Process + 628);
      if( (v136 & 0x40000000) != 0 )
      {
        *(_DWORD *)(p_ProcessInformation + 4) |= 1u;
        v136 = v135[628];
      }
      if( v136 < 0 )
        *(_DWORD *)(p_ProcessInformation + 4) |= 2u;
      v137 = Process;
      v138 = *((_DWORD *)Process + 629);
      if( (v138 & 0x1000) != 0 )
      {
        *(_DWORD *)(p_ProcessInformation + 4) |= 4u;
        v138 = v137[629];
      }
      if( (v138 & 0x2000) != 0 )
        *(_DWORD *)(p_ProcessInformation + 4) |= 8u;
      goto LABEL_505;
    case 15:
      i = 0;
      *(_DWORD *)(p_ProcessInformation + 4) = 0;
      v139 = Process;
      v140 = *((_DWORD *)Process + 629);
      if( (v140 & 0x4000) != 0 )
      {
        *(_DWORD *)(p_ProcessInformation + 4) |= 1u;
        v140 = v139[629];
      }
      if( (v140 & 0x8000) != 0 )
      {
        *(_DWORD *)(p_ProcessInformation + 4) |= 2u;
        v140 = v139[629];
      }
      if( (v140 & 0x20000) != 0 )
      {
        *(_DWORD *)(p_ProcessInformation + 4) |= 4u;
        v140 = v139[629];
      }
      if( (v140 & 0x40000) != 0 )
      {
        *(_DWORD *)(p_ProcessInformation + 4) |= 8u;
        v140 = v139[629];
      }
      if( (v140 & 0x100000) != 0 )
      {
        *(_DWORD *)(p_ProcessInformation + 4) |= 0x10u;
        v140 = v139[629];
      }
      if( (v140 & 0x200000) != 0 )
      {
        *(_DWORD *)(p_ProcessInformation + 4) |= 0x20u;
        v140 = v139[629];
      }
      if( (v140 & 0x400000) != 0 )
      {
        *(_DWORD *)(p_ProcessInformation + 4) |= 0x40u;
        v140 = v139[629];
      }
      if( (v140 & 0x800000) != 0 )
      {
        *(_DWORD *)(p_ProcessInformation + 4) |= 0x80u;
        v140 = v139[629];
      }
      if( (v140 & 0x40000000) != 0 )
      {
        *(_DWORD *)(p_ProcessInformation + 4) |= 0x100u;
        v140 = v139[629];
      }
      if( v140 < 0 )
        *(_DWORD *)(p_ProcessInformation + 4) |= 0x200u;
      goto LABEL_505;
    case 16:
      i = 0;
      RedirectionTrustPolicy = PspGetRedirectionTrustPolicy((_EPROCESS *)Process);
      *(_DWORD *)(p_ProcessInformation + 4) = 0;
      v133 = RedirectionTrustPolicy - 1;
      if( v133 )
      {
        if( v133 != 1 )
          goto LABEL_505;
        v134 = *(_DWORD *)(p_ProcessInformation + 4) | 2;
      }
      else
      {
        v134 = *(_DWORD *)(p_ProcessInformation + 4) | 1;
      }
      *(_DWORD *)(p_ProcessInformation + 4) = v134;
LABEL_505:
      if( a1 != -1 )
        ObfDereferenceObjectWithTag(Process, 0x79517350ui64);
      return i;
    default:
      i = -1073741637;
      goto LABEL_505;
  }
}

Referenced by: