ExpDebuggerWorker

VOID __stdcall ExpDebuggerWorker(VOID *Context){
  _KPROCESS *v1; 
  __int64 v2; 
  char v3; 
  char DefaultPagePriority; 
  unsigned int v5; 
  void *v6; 
  PVOID v7; 
  void *v8; 
  __int64 NextProcess; 
  _EPROCESS *v10; 
  __int64 v11; 
  NTSTATUS v12; 
  PVOID VirtualAddress; 
  __int64 v14; 
  _KAPC_STATE ApcState; 
  v1 = (_EPROCESS *)ExpDebuggerProcessAttach;
  v2 = ExpDebuggerProcessKill;
  v3 = EtwWmitraceWork;
  memset(&ApcState, 0, sizeof(ApcState));
  DefaultPagePriority = MmGetDefaultPagePriority();
  VirtualAddress = (PVOID)ExpDebuggerPageIn;
  v14 = 1i64;
  ExpDebuggerProcessKill = 0i64;
  v5 = DefaultPagePriority & 7 | 0xB8;
  ExpDebuggerProcessAttach = 0i64;
  ExpDebuggerPageIn = 0i64;
  _InterlockedExchange(&ExpDebuggerWork, 0);
  MmDbgMarkPfnModifiedWorker();
  v6 = 0i64;
  if( v1 || v2 )
  {
    v8 = 0i64;
    while( 1 )
    {
      NextProcess = PsGetNextProcess(v8);
      v6 = (void *)NextProcess;
      if( !NextProcess )
        break;
      if( (_EPROCESS *)NextProcess == v1 )
      {
        KiStackAttachProcess((_KPROCESS *)v1, 0i64, &ApcState);
        if( v6 )
          goto LABEL_3;
        break;
      }
      v8 = (void *)NextProcess;
      if( NextProcess == v2 )
      {
        PsTerminateProcess(NextProcess, 0x40010004u);
        goto LABEL_30;
      }
    }
    v10 = (_EPROCESS *)v2;
    if( v1 )
      v10 = v1;
    DbgPrintEx(
      0,
      0,
      "EX debug work: Unable to find process %p\n",
      v10,
      VirtualAddress,
      v14,
      ApcState.ApcListHead[0].Flink,
      ApcState.ApcListHead[0].Blink,
      ApcState.ApcListHead[1].Flink,
      ApcState.ApcListHead[1].Blink,
      ApcState.Process,
      *(_QWORD *)&ApcState.InProgressFlags);
  }
LABEL_3:
  v7 = VirtualAddress;
  if( VirtualAddress )
  {
    if( (unsigned int)MmIsSessionAddress(VirtualAddress) )
      v11 = -3i64;
    else
      v11 = -(__int64)((unsigned __int64)VirtualAddress < 0xFFFF800000000000ui64);
    v12 = MmPrefetchVirtualMemory((CHAR *)v11, 1ui64, (INT64)&VirtualAddress, v5);
    if( v12 < 0 )
      DbgPrintEx(0, 0, "EX page in: MmPrefetchVirtualMemory failed, 0x%08x\n", (unsigned int)v12);
    v7 = VirtualAddress;
  }
  if( v3 )
  {
    EtwWmitraceWorker();
    v7 = VirtualAddress;
  }
  if( v1 || v2 || v7 || v3 )
    DbgBreakPointWithStatus(7u);
  if( v6 )
  {
    KiUnstackDetachProcess(&ApcState, 0i64);
LABEL_30:
    PsQuitNextProcessThread(v6);
  }
}

Referenced by: