PsLookupProcessByProcessId function. 04/16/2018; 2 minutes to read In this article. The PsLookupProcessByProcessId routine accepts the process ID of a process and returns a referenced pointer to EPROCESS structure of the process.. Syntax NTKERNELAPI NTSTATUS PsLookupProcessByProcessId( HANDLE ProcessId, PEPROCESS *Process );