EtwpIsProcessZombie

UINT64 __stdcall EtwpIsProcessZombie(_EPROCESS *Process){
  return(Process->Flags & 4) != 0
      && *(_DWORD *)&Process->Pcb.gap0[4]
      && !Process->ActiveThreads
      && Process->Pcb.ThreadListHead.Flink == &Process->Pcb.ThreadListHead;
}

Referenced by: