KeQueryValuesThread

__int64 __fastcall KeQueryValuesThread(__int64 a1, __int64 a2){
  char v3; 
  unsigned __int8 CurrentIrql; 
  struct _KPRCB *CurrentPrcb; 
  _KPRCB **v7; 
  int v8; 
  _KPRCB *v9; 
  volatile signed __int32 *v10; 
  char v11; 
  char v12; 
  int v13; 
  __int64 v14; 
  __int64 v15; 
  char v16; 
  __int64 v17; 
  __int64 result; 
  __int64 v19; 
  struct _KPRCB *v20; 
  __int64 v21; 
  struct _KPRCB *v22; 
  struct _KPRCB *v23; 
  __int64 v24; 
  struct _KPRCB *v25; 
  __int64 v26; 
  struct _KPRCB *v27; 
  __int64 v28; 
  __int64 v29; 
  __int64 v30; 
  __int64 v31; 
  __int64 v32; 
  UINT64 v33[3]; 
  UINT64 SpinCount; 
  UINT64 v35; 
  UINT64 v36; 
  UINT64 v37; 
  *(_DWORD *)a2 = 0;
  v3 = 0;
  CurrentIrql = KeGetCurrentIrql();
  __writecr8(2ui64);
  CurrentPrcb = KeGetCurrentPrcb();
  LODWORD(SpinCount) = 0;
  while( _interlockedbittestandset64((volatile signed __int32 *)(a1 + 64), 0i64) )
  {
    do
      KeYieldProcessorEx(&SpinCount);
    while( *(_QWORD *)(a1 + 64) );
    v28 = *((_QWORD *)CurrentPrcb + 4247);
    if( v28 && *((_BYTE *)CurrentPrcb + 32) <= 1u )
      ++*(_DWORD *)(v28 + 24);
  }
  if( *(__int64 **)(a1 + 544) == KiInitialProcess )
  {
    LOBYTE(v8) = *(_BYTE *)(a1 + 388);
    *(_BYTE *)(a2 + 10) = 1;
    goto LABEL_20;
  }
LABEL_4:
  v7 = &KiProcessorBlock;
  while( 1 )
  {
    while( 1 )
    {
      v8 = *(unsigned __int8 *)(a1 + 388);
      v9 = 0i64;
      v10 = 0i64;
      if( v8 == 5 )
      {
        v11 = *(_BYTE *)(a1 + 112) & 7;
        if( v11 == 1 || (unsigned __int8)(v11 - 3) <= 3u )
          goto LABEL_7;
        LOBYTE(v8) = 2;
        goto LABEL_35;
      }
      if( *(_BYTE *)(a1 + 388) == 1 )
        break;
      if( *(_BYTE *)(a1 + 388) == 2 )
      {
LABEL_35:
        v21 = *(unsigned int *)(a1 + 536);
        if( (int)v21 >= 0 )
        {
          v23 = KeGetCurrentPrcb();
          v9 = v7[v21];
          LODWORD(v33[0]) = 0;
          while( _interlockedbittestandset64((volatile signed __int32 *)v9 + 12, 0i64) )
          {
            do
            {
              KeYieldProcessorEx(v33);
              v21 = *((_QWORD *)v9 + 6);
            }
            while( v21 );
            v29 = *((_QWORD *)v23 + 4247);
            if( v29 && *((_BYTE *)v23 + 32) <= 1u )
            {
              LODWORD(v21) = *(_DWORD *)(v29 + 24) + 1;
              *(_DWORD *)(v29 + 24) = v21;
            }
          }
          if( a1 == *((_QWORD *)v9 + 1) )
            goto LABEL_7;
LABEL_30:
          _InterlockedAnd64((volatile signed __int64 *)v9 + 6, 0i64);
          goto LABEL_31;
        }
      }
      else
      {
        if( *(_BYTE *)(a1 + 388) != 3 )
          goto LABEL_7;
        v19 = *(unsigned int *)(a1 + 536);
        if( (int)v19 >= 0 )
        {
          v20 = KeGetCurrentPrcb();
          v9 = v7[v19];
          LODWORD(v35) = 0;
          while( _interlockedbittestandset64((volatile signed __int32 *)v9 + 12, 0i64) )
          {
            do
              KeYieldProcessorEx(&v35);
            while( *((_QWORD *)v9 + 6) );
            v32 = *((_QWORD *)v20 + 4247);
            if( v32 && *((_BYTE *)v20 + 32) <= 1u )
              ++*(_DWORD *)(v32 + 24);
          }
          if( a1 == *((_QWORD *)v9 + 2) )
            goto LABEL_7;
          LODWORD(v21) = *(unsigned __int8 *)(a1 + 388);
          if( (_BYTE)v21 == 3 )
          {
            LODWORD(v21) = *(_DWORD *)(a1 + 536);
            if( (_DWORD)v21 == (_DWORD)v19 )
              __fastfail(0x1Eu);
          }
          goto LABEL_30;
        }
      }
    }
    v24 = *(unsigned int *)(a1 + 536);
    if( (int)v24 >= 0 )
    {
      v27 = KeGetCurrentPrcb();
      v9 = v7[v24];
      LODWORD(v37) = 0;
      while( _interlockedbittestandset64((volatile signed __int32 *)v9 + 12, 0i64) )
      {
        do
          KeYieldProcessorEx(&v37);
        while( *((_QWORD *)v9 + 6) );
        v30 = *((_QWORD *)v27 + 4247);
        if( v30 && *((_BYTE *)v27 + 32) <= 1u )
          ++*(_DWORD *)(v30 + 24);
      }
      LODWORD(v21) = *(unsigned __int8 *)(a1 + 388);
      if( (_BYTE)v21 == 1 )
      {
        LODWORD(v21) = *(_DWORD *)(a1 + 536);
        if( (_DWORD)v21 == (_DWORD)v24 )
          goto LABEL_7;
      }
      goto LABEL_30;
    }
    v25 = KeGetCurrentPrcb();
    v26 = (unsigned int)v24;
    LODWORD(v26) = v24 & 0x7FFFFFFF;
    LODWORD(v36) = 0;
    v10 = (volatile signed __int32 *)*((_QWORD *)v7[v26] + 4233);
    while( _interlockedbittestandset64(v10, 0i64) )
    {
      do
        KeYieldProcessorEx(&v36);
      while( *(_QWORD *)v10 );
      v31 = *((_QWORD *)v25 + 4247);
      if( v31 && *((_BYTE *)v25 + 32) <= 1u )
        ++*(_DWORD *)(v31 + 24);
    }
    LODWORD(v21) = *(unsigned __int8 *)(a1 + 388);
    if( (_BYTE)v21 == 1 )
    {
      LODWORD(v21) = *(_DWORD *)(a1 + 536);
      if( (_DWORD)v21 == (_DWORD)v24 )
        break;
    }
    _InterlockedAnd64((volatile signed __int64 *)v10, 0i64);
LABEL_31:
    v22 = KeGetCurrentPrcb();
    v7 = (_KPRCB **)*((_QWORD *)v22 + 4247);
    if( !v7 || *((_BYTE *)v22 + 32) > 1u || !(_DWORD)v21 )
      goto LABEL_4;
  }
  v9 = 0i64;
LABEL_7:
  *(_DWORD *)a2 = *(_DWORD *)(a1 + 436);
  v12 = *(_BYTE *)(a1 + 388);
  v13 = *(_DWORD *)(a1 + 132);
  if( v12 == 1 || v12 == 7 && (*(_DWORD *)(a1 + 116) & 2) != 0 )
    v13 += KUSER_SHARED_DATA.TickCount.LowPart - *(_DWORD *)(a1 + 436);
  *(_DWORD *)(a2 + 4) = v13;
  v14 = *(_QWORD *)(a1 + 992);
  v15 = *(_QWORD *)(a1 + 1000);
  if( *(_BYTE *)(a1 + 388) == 5 )
  {
    v16 = *(_BYTE *)(a1 + 112) & 7;
    if( v16 == 1 || (unsigned __int8)(v16 - 3) <= 3u )
    {
      v17 = KUSER_SHARED_DATA.TickCount.LowPart - *(_DWORD *)(a1 + 436);
      if( *(_BYTE *)(a1 + 391) )
        v15 += v17;
      else
        v14 += v17;
    }
  }
  *(_QWORD *)(a2 + 16) = v14;
  *(_QWORD *)(a2 + 24) = v15;
  if( v9 )
    _InterlockedAnd64((volatile signed __int64 *)v9 + 6, 0i64);
  if( v10 )
    _InterlockedAnd64((volatile signed __int64 *)v10, 0i64);
  v3 = *(_BYTE *)(a1 + 643);
  *(_BYTE *)(a2 + 10) = *(_BYTE *)(a1 + 195);
  if( (_BYTE)v8 == 5 && (*(_BYTE *)(a1 + 112) & 7) == 4 )
    v3 = 5;
LABEL_20:
  *(_BYTE *)(a2 + 11) = *(_BYTE *)(a1 + 563);
  *(_QWORD *)(a1 + 64) = 0i64;
  result = CurrentIrql;
  __writecr8(CurrentIrql);
  *(_BYTE *)(a2 + 9) = v3;
  *(_BYTE *)(a2 + 8) = v8;
  return result;
}

Referenced by: