PsCaptureExceptionPort

VOID *__stdcall PsCaptureExceptionPort(_EPROCESS *Process){
  _ETHREAD *CurrentThread; 
  _EX_PUSH_LOCK *p_ProcessLock; 
  void *v4; 

  if( !Process->ExceptionPortValue )
    return 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  p_ProcessLock = &Process->ProcessLock;
  ExAcquirePushLockSharedEx(&Process->ProcessLock, 0i64);
  v4 = (void *)(Process->ExceptionPortValue & 0xFFFFFFFFFFFFFFF8ui64);
  ObfReferenceObject(v4);
  if( _InterlockedCompareExchange64(&p_ProcessLock->_bf_0, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared(p_ProcessLock);
  KeAbPostRelease(p_ProcessLock);
  KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
  return v4;
}

Referenced by: