PsGetThreadProperty

PVOID __stdcall PsGetThreadProperty(_ETHREAD *Thread, ULONG_PTR Key, ULONG Flags){
  void *v3; 
  char v4; 
  _QWORD *v7; 
  UINT64 *v8; 
  unsigned __int8 CurrentIrql; 
  _QWORD *v10; 
  _QWORD *v11; 
  __int64 v12; 
  _EJOB *v14; 
  void *v15; 
  v3 = 0i64;
  v4 = Flags;
  if( (Flags & 0xFFFFFFFE) != 0
    || Thread == *((_ETHREAD **)KeGetCurrentPrcb() + 3)
    || KeGetCurrentIrql() < 2u
    && (POBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ *((unsigned __int8 *)Thread - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Thread - 48) >> 8)] != PsThreadType
    || Thread == (_ETHREAD *)KeGetCurrentThread() && (*((_DWORD *)KeGetPcr() + 3243) & 0x10001) != 0 )
  {
    return 0i64;
  }
  v7 = (_QWORD *)((char *)Thread + 1480);
  v8 = (UINT64 *)((char *)Thread + 1496);
  CurrentIrql = KeGetCurrentIrql();
  __writecr8(2ui64);
  if( _interlockedbittestandset64((volatile signed __int32 *)Thread + 374, 0i64) )
    KxWaitForSpinLockAndAcquire(v8);
  v10 = (_QWORD *)*v7;
  v11 = 0i64;
  if( (_QWORD *)*v7 != v7 )
  {
    while( v10[2] != Key )
    {
      v10 = (_QWORD *)*v10;
      if( v10 == v7 )
        goto LABEL_15;
    }
    v11 = v10;
    if( v10 )
    {
      v12 = v10[3];
      if( ObpTraceFlags )
        ObpPushStackInfo(v12 - 48, 1, 1i64, 1917875024i64);
      ObpIncrPointerCount((volatile INT64 *)(v12 - 48));
    }
  }
LABEL_15:
  _InterlockedAnd64((volatile signed __int64 *)v8, 0i64);
  __writecr8(CurrentIrql);
  if( v11 )
    return(PVOID)v11[3];
  if( (v4 & 1) == 0 )
  {
    v14 = (_EJOB *)*((_QWORD *)Thread + 193);
    if( v14 == (_EJOB *)-3i64 )
      v14 = *(_EJOB **)(*((_QWORD *)Thread + 68) + 1296i64);
    if( v14 )
    {
      LODWORD(v15) = PsGetJobProperty(v14, Key);
      return v15;
    }
  }
  return v3;
}

Referenced by: