.text:F82241C0 ; NTSTATUS __stdcall KavNtTerminateProcess(HANDLE ThreadHandle,NTSTATUS ExitStatus)
.text:F82241C0 KavNtTerminateProcess proc near         ; DATA XREF: sub_F82249D0+ABo
.text:F82241C0
.text:F82241C0 var_58          = dword ptr -58h
.text:F82241C0 ProcessObject   = dword ptr -54h
.text:F82241C0 ProcessData     = KAV_TERMINATE_PROCESS_DATA ptr -50h
.text:F82241C0 var_4           = dword ptr -4
.text:F82241C0 ProcessHandle   = dword ptr  4
.text:F82241C0 ExitStatus      = dword ptr  8
.text:F82241C0
.text:F82241C0    sub     esp, 54h
.text:F82241C3    push    ebx
.text:F82241C4    xor     ebx, ebx
.text:F82241C6    push    esi
.text:F82241C7    mov     [esp+5Ch+ProcessObject], ebx
.text:F82241CB    call    KeGetCurrentIrql
.text:F82241D0    mov     esi, [esp+5Ch+ProcessHandle]
.text:F82241D4    cmp     al, 2           ;
.text:F82241D4               ; IRQL >= DISPATCH_LEVEL? Abort
.text:F82241D4               ; ( This is impossible for a system service )
.text:F82241D6    jnb     Ret_KavNtTerminateProcess
.text:F82241DC    cmp     esi, ebx        ;
.text:F82241DC               ; Null process handle? Abort
.text:F82241DE    jz      Ret_KavNtTerminateProcess
.text:F82241E4    call    PsGetCurrentProcessId
.text:F82241E9    mov     [esp+5Ch+ProcessData.CurrentProcessId], eax
.text:F82241ED    xor     eax, eax
.text:F82241EF    cmp     esi, 0FFFFFFFFh
.text:F82241F2    push    esi             ; ProcessHandle
.text:F82241F3    setnz   al
.text:F82241F6    dec     eax
.text:F82241F7    mov     [esp+60h+ProcessData.TargetIsCurrentProcess], eax
.text:F82241FB    call    KavGetProcessIdFromProcessHandle
.text:F8224200    lea     ecx, [esp+5Ch+ProcessObject] ; Object
.text:F8224204    push    ebx             ; HandleInformation
.text:F8224205    push    ecx             ; Object
.text:F8224206    push    ebx             ; AccessMode
.text:F8224207    push    ebx             ; ObjectType
.text:F8224208    push    0F0000h         ; DesiredAccess
.text:F822420D    push    esi             ; Handle
.text:F822420E    mov     [esp+74h+ProcessData.TargetProcessId], eax
.text:F8224212    mov     [esp+74h+var_4], ebx
.text:F8224216    call    ds:ObReferenceObjectByHandle
.text:F822421C    test    eax, eax
.text:F822421E    jl      short loc_F8224246
.text:F8224220    mov     edx, [esp+5Ch+ProcessObject]
.text:F8224224    mov     eax, g_EprocessNameOffset
.text:F8224229    add     eax, edx
.text:F822422B    push    40h             ; size_t
.text:F822422D    lea     ecx, [esp+60h+ProcessData.ProcessName]
.text:F8224231    push    eax             ; char *
.text:F8224232    push    ecx             ; char *
.text:F8224233    call    ds:strncpy
.text:F8224239    mov     ecx, [esp+68h+ProcessObject]
.text:F822423D    add     esp, 0Ch
.text:F8224240    call    ds:ObfDereferenceObject
.text:F8224246
.text:F8224246 loc_F8224246:              ; CODE XREF: KavNtTerminateProcess+5Ej
.text:F8224246    cmp     esi, 0FFFFFFFFh
.text:F8224249    jnz     short loc_F8224255
.text:F822424B    mov     edx, [esp+5Ch+ProcessData.TargetProcessId]
.text:F822424F    push    edx
.text:F8224250    call    sub_F8226710
.text:F8224255
.text:F8224255 loc_F8224255:              ; CODE XREF: KavNtTerminateProcess+89j
.text:F8224255    lea     eax, [esp+5Ch+ProcessData]
.text:F8224259    push    ebx             ; int
.text:F822425A    push    eax             ; ProcessData
.text:F822425B    call    KavCheckTerminateProcess
.text:F8224260    cmp     eax, 7
.text:F8224263    jz      short loc_F822427D
.text:F8224265    cmp     eax, 1
.text:F8224268    jz      short loc_F822427D
.text:F822426A    cmp     eax, ebx
.text:F822426C    jz      short loc_F822427D
.text:F822426E    mov     esi, STATUS_ACCESS_DENIED
.text:F8224273    mov     eax, esi
.text:F8224275    pop     esi
.text:F8224276    pop     ebx
.text:F8224277    add     esp, 54h
.text:F822427A    retn    8
.text:F822427D ; ---------------------------------------------------------------------------
.text:F822427D
.text:F822427D loc_F822427D:              ; CODE XREF: KavNtTerminateProcess+A3j
.text:F822427D               ; KavNtTerminateProcess+A8j ...
.text:F822427D    mov     eax, [esp+5Ch+ProcessData.TargetProcessId]
.text:F8224281    cmp     eax, 1000h
.text:F8224286    jnb     short loc_F8224296
.text:F8224288    mov     dword_F8228460[eax*8], ebx
.text:F822428F    mov     byte_F8228464[eax*8], bl
.text:F8224296
.text:F8224296 loc_F8224296:              ; CODE XREF: KavNtTerminateProcess+C6j
.text:F8224296    push    eax
.text:F8224297    call    sub_F82134D0
.text:F822429C    mov     ecx, [esp+5Ch+ProcessData.TargetProcessId]
.text:F82242A0    push    ecx
.text:F82242A1    call    sub_F8221F70
.text:F82242A6    mov     edx, [esp+5Ch+ExitStatus]
.text:F82242AA    push    edx
.text:F82242AB    push    esi
.text:F82242AC    call    OrigNtTerminateProcess
.text:F82242B2    mov     esi, eax
.text:F82242B4    lea     eax, [esp+5Ch+ProcessData]
.text:F82242B8    push    1               ; int
.text:F82242BA    push    eax             ; ProcessData
.text:F82242BB    mov     [esp+64h+var_4], esi
.text:F82242BF    call    KavCheckTerminateProcess
.text:F82242C4    mov     eax, esi
.text:F82242C6    pop     esi
.text:F82242C7    pop     ebx
.text:F82242C8    add     esp, 54h
.text:F82242CB    retn    8
.text:F82242CE ; ---------------------------------------------------------------------------
.text:F82242CE
.text:F82242CE Ret_KavNtTerminateProcess:              ; CODE XREF: KavNtTerminateProcess+16j
.text:F82242CE               ; KavNtTerminateProcess+1Ej
.text:F82242CE    mov     ecx, [esp+5Ch+ExitStatus]
.text:F82242D2    push    ecx
.text:F82242D3    push    esi
.text:F82242D4    call    OrigNtTerminateProcess
.text:F82242DA    pop     esi
.text:F82242DB    pop     ebx
.text:F82242DC    add     esp, 54h
.text:F82242DF    retn    8
.text:F82242DF KavNtTerminateProcess endp