PsCreateSystemThreadEx

__int64 __fastcall PsCreateSystemThreadEx(
        __int64 a1,
        int a2,
        __int128 *a3,
        VOID *a4,
        __int64 a5,
        VOID *a6,
        INT64 a7,
        __int128 *a8,
        _DWORD *a9){
  __int128 *v10; 
  char v13; 
  _EPROCESS *v14; 
  $65F3D318EB14490C2A61100CD615354D *v15; 
  NTSTATUS v16; 
  __int128 v18; 
  __int128 v19; 
  unsigned int v20; 
  __int128 v21; 
  int v22; 
  UINT64 Tag; 
  VOID *Object; 
  int v25; 
  _OBJECT_ATTRIBUTES v26; 
  INT64 v27; 
  VOID *v28; 
  __int64 v29; 
  __int128 v30; 
  __int128 v31[33]; 

  v10 = a8;
  v29 = a5;
  v28 = a6;
  v25 = a2;
  v27 = a7;
  memset(v31, 0i64, 0x208u);
  memset(&v26, 0, sizeof(v26));
  Object = 0i64;
  v30 = 0i64;
  if( KeGetCurrentIrql() > 1u )
    KeBugCheckEx(0xC8u, (PVOID)(((unsigned __int64)KeGetCurrentIrql() << 16) | 4), 0i64, 0i64, 0i64);
  v13 = 0;
  if( a4 )
  {
    LODWORD(Tag) = 1917023056;
    v16 = ObpReferenceObjectByHandleWithTag(a4, 2ui64, (_OBJECT_TYPE *)PsProcessType, 0, Tag, &Object, 0i64, 0i64);
    if( v16 < 0 )
      return(unsigned int)v16;
    v14 = (_EPROCESS *)Object;
    v13 = 1;
  }
  else
  {
    v14 = *(_EPROCESS **)(PspSystemPartition + 104);
    Object = v14;
  }
  v15 = &v14->2172;
  if( (v14->Flags3 & 0x1000) != 0 )
  {
    if( a8 )
      goto LABEL_17;
    if( !a9 )
    {
      v20 = (unsigned __int16)(_InterlockedExchangeAdd(&PspSystemThreadAssignment, 1u) + 1);
      v10 = &v30;
      WORD4(v30) = v20 % KeQueryActiveGroupCount();
      v14 = (_EPROCESS *)Object;
      *(_QWORD *)&v30 = KeActiveProcessors.Bitmap[WORD4(v30)];
    }
    if( v10 )
    {
LABEL_17:
      v21 = *v10;
      v22 = 4096;
      DWORD1(v31[0]) = 4096;
      v31[20] = v21;
    }
    else
    {
      v22 = DWORD1(v31[0]);
    }
    if( a9 )
    {
      DWORD1(v31[0]) = v22 | 0x4000;
      HIDWORD(v31[15]) = *a9;
    }
  }
  if( a3 )
  {
    v18 = *a3;
    *(_OWORD *)&v26.ObjectName = a3[1];
    *(_OWORD *)&v26.Length = v18;
    v19 = a3[2];
    v26.Attributes = _mm_cvtsi128_si32(_mm_srli_si128(*(__m128i *)&v26.ObjectName, 8)) | 0x200;
    *(_OWORD *)&v26.SecurityDescriptor = v19;
  }
  else
  {
    v26.Length = 48;
    *(_OWORD *)&v26.SecurityDescriptor = 0i64;
    v26.RootDirectory = 0i64;
    v26.Attributes = 512;
    v26.ObjectName = 0i64;
  }
  v16 = PspCreateThread(
          a1,
          v25,
          &v26,
          0i64,
          v14,
          (PSP_CREATE_PROCESS_CONTEXT *)((unsigned __int64)v31 & -(__int64)((v15->Flags3 & 0x1000) != 0)),
          v29,
          0i64,
          0i64,
          0,
          v28,
          v27,
          0i64);
  if( v13 )
    ObfDereferenceObjectWithTag(v14, 0x72437350ui64);
  return(unsigned int)v16;
}

Referenced by: