NtAcquireProcessActivityReference

NTSTATUS __fastcall NtAcquireProcessActivityReference(PVOID *a1, VOID *a2, int a3){
  char PreviousMode; 
  __int64 v6; 
  NTSTATUS result; 
  VOID *v8; 
  NTSTATUS ActivityReference; 
  UINT64 Tag; 
  void *Handle[3]; 
  PVOID Object; 

  Handle[0] = 0i64;
  Object = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( PreviousMode )
  {
    v6 = 0x7FFFFFFF0000i64;
    if( (unsigned __int64)a1 < 0x7FFFFFFF0000i64 )
      v6 = (__int64)a1;
    *(_QWORD *)v6 = *(_QWORD *)v6;
  }
  if( a3 )
    return -1073741583;
  result = ExCpuSetResourceManagerAccessCheck(PreviousMode);
  if( result >= 0 )
  {
    LODWORD(Tag) = 1665233744;
    result = ObReferenceObjectByHandleWithTag(
               a2,
               0x1000ui64,
               (_OBJECT_TYPE *)PsProcessType,
               PreviousMode,
               Tag,
               &Object,
               0i64);
    if( result >= 0 )
    {
      v8 = Object;
      ActivityReference = PspCreateActivityReference(Object, (INT64)Handle);
      if( ActivityReference >= 0 )
        *a1 = Handle[0];
      ObfDereferenceObjectWithTag(v8, 0x63417350ui64);
      return ActivityReference;
    }
  }
  return result;
}

Referenced by: