NtTerminateProcess

NTSTATUS __stdcall NtTerminateProcess(VOID *ProcessHandle, NTSTATUS ExitStatus){
  _ETHREAD *CurrentThread; 
  unsigned int v3; 
  INT64 v5; 
  INT8 PreviousMode; 
  NTSTATUS result; 
  _EPROCESS *v8; 
  unsigned int UniqueProcessId; 
  unsigned int v10; 
  signed __int32 v11; 
  signed __int32 v12; 
  UINT64 Tag; 
  _EPROCESS *Process; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v3 = 0;
  Process = 0i64;
  v5 = (INT64)CurrentThread->Tcb.ApcState.Process;
  PreviousMode = CurrentThread->Tcb.PreviousMode;
  if( ProcessHandle )
  {
    LODWORD(Tag) = 1700033360;
    result = ObReferenceObjectByHandleWithTag(
               ProcessHandle,
               1ui64,
               (_OBJECT_TYPE *)PsProcessType,
               PreviousMode,
               Tag,
               (VOID **)&Process,
               0i64);
    if( result < 0 )
      return result;
    if( !PreviousMode && (*(_BYTE *)(v5 + 992) & 1) == 0 )
      v3 = 1;
    v8 = Process;
  }
  else
  {
    Process = CurrentThread->Tcb.ApcState.Process;
    v8 = (_EPROCESS *)v5;
    if( PreviousMode != 1 && (*(_BYTE *)(v5 + 992) & 1) == 0 || (*(_DWORD *)(v5 + 2172) & 1) != 0 )
      return -1073741637;
    if( (CurrentThread->Tcb.gap0[3] & 0x40) == 0 )
    {
      PspLockProcessExclusive((_EPROCESS *)v5, CurrentThread);
      _m_prefetchw((const void *)(v5 + 1124));
      v11 = *(_DWORD *)(v5 + 1124);
      do
      {
        v12 = v11;
        v11 = _InterlockedCompareExchange((volatile signed __int32 *)(v5 + 1124), v11 | 0x40000000, v11);
      }
      while( v12 != v11 );
      if( (v11 & 0x40000008) != 0 )
      {
        PspUnlockProcessExclusive((_EPROCESS *)v5, CurrentThread);
        PspTerminateThreadByPointer(CurrentThread, (unsigned int)ExitStatus, 1u);
        return 0;
      }
      CurrentThread->SameThreadPassiveFlags |= 0x40u;
      if( *(_DWORD *)(v5 + 2004) == 259 )
        *(_DWORD *)(v5 + 2004) = ExitStatus;
      PspUnlockProcessExclusiveUnsafe(v5);
      v10 = PspTerminateAllThreads(v5, (ULONG_PTR)CurrentThread, (unsigned int)ExitStatus, 0i64);
      goto LABEL_17;
    }
    ObfReferenceObjectWithTag((VOID *)v5, 0x65547350ui64);
  }
  UniqueProcessId = (unsigned int)v8->UniqueProcessId;
  --CurrentThread->Tcb.KernelApcDisable;
  v10 = PspTerminateProcess(v8, CurrentThread, (unsigned int)ExitStatus, v3);
  ObfDereferenceObjectWithTag(v8, 0x65547350ui64);
  if( v8 == (_EPROCESS *)v5 )
  {
    if( PreviousMode == 1 || (*(_BYTE *)(v5 + 992) & 1) != 0 )
    {
      _InterlockedOr((volatile signed __int32 *)&CurrentThread->1296, 1u);
      KeForceResumeThread(CurrentThread);
      KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
      PspExitThread((unsigned int)ExitStatus);
      __debugbreak();
    }
  }
  else
  {
    PspLogAuditTerminateRemoteProcessEvent(UniqueProcessId, v10);
  }
LABEL_17:
  KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
  return v10;
}

Referenced by: