NtQueueApcThreadEx

NTSTATUS __stdcall NtQueueApcThreadEx(
        PVOID ThreadHandle,
        PVOID UserApcReserveHandle,
        PVOID ApcRoutine,
        PVOID ptr32,
        PVOID ptr32a,
        PVOID SystemArgument2,
        PVOID ApcArgument1,
        PVOID ApcArgument2,
        PVOID ApcArgument3){
  VOID *v10; 
  bool v13; 
  char PreviousMode; 
  NTSTATUS result; 
  _ETHREAD *v16; 
  _EWOW64PROCESS *WoW64Process; 
  unsigned __int16 Machine; 
  _EWOW64PROCESS *v19; 
  char *PoolWithQuotaTag; 
  void *v21; 
  void(__fastcall *v22)(char *); 
  int v23; 
  PVOID Object; 
  _ETHREAD *Thread; 

  v10 = 0i64;
  v13 = 1;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( UserApcReserveHandle != (PVOID)1 )
    v10 = UserApcReserveHandle;
  Thread = 0i64;
  result = ObReferenceObjectByHandle(
             ThreadHandle,
             0x10ui64,
             (_OBJECT_TYPE *)PsThreadType,
             PreviousMode,
             (VOID **)&Thread,
             0i64);
  if( result >= 0 )
  {
    v16 = Thread;
    if( (Thread->Tcb._bf_0 & 0x400) != 0
      || (v16 = Thread, (WoW64Process = KeGetCurrentThread()->ApcState.Process->WoW64Process) != 0i64)
      && ((Machine = WoW64Process->Machine, Machine == 332) || Machine == 452)
      && ((v19 = Thread->Tcb.Process->WoW64Process) == 0i64 || v19->Machine == 0x8664)
      && (unsigned __int64)-((__int64)ApcRoutine >> 2) <= 0xFFFFFFFF )
    {
      v23 = -1073741816;
    }
    else if( v10 )
    {
      Object = 0i64;
      v23 = ObReferenceObjectByHandle(v10, 2ui64, PspMemoryReserveObjectTypes, PreviousMode, &Object, 0i64);
      if( v23 >= 0 )
      {
        if( !_InterlockedCompareExchange((volatile signed __int32 *)Object, 1, 0) )
        {
          v21 = PspUserApcReserveKernelRoutine;
          v16 = Thread;
          v22 = (void(__fastcall *)(char *))PspUserApcReserveKernelRoutine;
          PoolWithQuotaTag = (char *)Object + 8;
LABEL_15:
          KeInitializeApc(
            (INT64)PoolWithQuotaTag,
            (INT64)v16,
            0i64,
            (INT64)v21,
            (INT64)v22,
            (INT64)ApcRoutine,
            v13,
            (INT64)ptr32);
          if( KeInsertQueueApc((INT64)PoolWithQuotaTag, (INT64)ptr32a, (INT64)SystemArgument2, 0i64) )
          {
            v23 = 0;
          }
          else
          {
            v22(PoolWithQuotaTag);
            v23 = -1073741823;
          }
          goto LABEL_17;
        }
        HalPutDmaAdapter((PADAPTER_OBJECT)Object);
        v16 = Thread;
        v23 = -1073741584;
      }
    }
    else
    {
      PoolWithQuotaTag = (char *)ExAllocatePoolWithQuotaTag((POOL_TYPE)520, 0x58ui64, 0x70617350ui64);
      if( PoolWithQuotaTag )
      {
        v21 = KeSpecialUserApcKernelRoutine;
        v22 = (void(__fastcall *)(char *))ExFreePoolWithTag;
        v13 = UserApcReserveHandle != (PVOID)1;
        if( UserApcReserveHandle != (PVOID)1 )
          v21 = SC_ENV::Free;
        goto LABEL_15;
      }
      v23 = -1073741801;
    }
LABEL_17:
    HalPutDmaAdapter((PADAPTER_OBJECT)v16);
    return v23;
  }
  return result;
}

Referenced by: