PspCreatePicoThread

__int64 __fastcall PspCreatePicoThread(__int64 a1, __int64 a2, __int64 *a3){
  struct _EX_RUNDOWN_REF *v6; 
  _ETHREAD *CurrentThread; 
  unsigned int v8; 
  int Thread; 
  __int64 v10; 
  INT64 *v11; 
  INT64 a9; 
  PADAPTER_OBJECT DmaAdapter; 
  PVOID Object; 
  __int64 a10; 
  INT64 a6[2]; 
  __int64 v18; 
  INT64 result[66]; 
  INT32 v20[15]; 
  __int16 v21; 
  __int16 v22; 
  __int64 v23; 
  __int64 v24; 
  __int64 v25; 
  __int64 v26; 
  __int64 v27; 
  __int64 v28; 
  __int64 v29; 
  __int64 v30; 
  __int64 v31; 
  __int64 v32; 
  __int64 v33; 
  __int64 v34; 
  __int64 v35; 
  __int64 v36; 
  INT64 a12[50]; 
  memset((INT64)result, 0i64);
  v6 = 0i64;
  LODWORD(a9) = 0;
  a10 = 0i64;
  memset((INT64)a12, 0i64);
  DmaAdapter = 0i64;
  v18 = 0i64;
  *(_OWORD *)a6 = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v8 = 0;
  Object = 0i64;
  if( !*(_QWORD *)(a1 + 184) )
  {
    v6 = (struct _EX_RUNDOWN_REF *)Object;
    Thread = -1073741811;
    goto LABEL_18;
  }
  Thread = ObReferenceObjectByHandleWithTag(
             *(HANDLE *)a1,
             2u,
             (POBJECT_TYPE)PsProcessType,
             0,
             0x72437350u,
             &Object,
             0i64);
  if( Thread >= 0 )
  {
    v6 = (struct _EX_RUNDOWN_REF *)Object;
    if( *((_QWORD *)Object + 280) )
    {
      --*((_WORD *)CurrentThread + 242);
      v8 = 1;
      if( ExAcquireRundownProtection(v6 + 139) )
      {
        v8 = 3;
        ObfReferenceObjectWithTag(v6, 0x72437350u);
        memset((INT64)v20, 0i64);
        PspCreateUserContext((INT64)v20, 0, *(_QWORD *)(a1 + 16), *(_QWORD *)(a1 + 24), *(_QWORD *)(a1 + 32));
        v10 = *(_QWORD *)(a1 + 8);
        v21 = *(_WORD *)(a1 + 56);
        v22 = *(_WORD *)(a1 + 58);
        a6[1] = *(_QWORD *)(a1 + 40);
        v18 = *(_QWORD *)(a1 + 48);
        v23 = *(_QWORD *)(a1 + 64);
        v24 = *(_QWORD *)(a1 + 72);
        v28 = *(_QWORD *)(a1 + 96);
        v27 = *(_QWORD *)(a1 + 104);
        v26 = *(_QWORD *)(a1 + 112);
        v29 = *(_QWORD *)(a1 + 120);
        v30 = *(_QWORD *)(a1 + 128);
        v31 = *(_QWORD *)(a1 + 136);
        v32 = *(_QWORD *)(a1 + 144);
        v33 = *(_QWORD *)(a1 + 152);
        v34 = *(_QWORD *)(a1 + 160);
        v35 = *(_QWORD *)(a1 + 168);
        v36 = *(_QWORD *)(a1 + 176);
        v25 = v10;
        LODWORD(a9) = 1;
        a6[0] = 0i64;
        Thread = PspAllocateThread(
                   (INT64)v6,
                   0i64,
                   0,
                   0i64,
                   v20,
                   (INT64)a6,
                   0i64,
                   0i64,
                   (INT64)&a9,
                   (INT64)&DmaAdapter,
                   0i64,
                   (INT64)a12);
        if( Thread < 0 )
        {
          DmaAdapter = 0i64;
LABEL_17:
          ExReleaseRundownProtection(v6 + 139);
          goto LABEL_18;
        }
        v11 = 0i64;
        if( a2 )
        {
          result[57] = a2;
          v11 = result;
        }
        *(_QWORD *)&DmaAdapter[94].Version = *(_QWORD *)(a1 + 184);
        Thread = PspInsertThread(
                   DmaAdapter,
                   (ULONG_PTR)v6,
                   0i64,
                   &a9,
                   0x1FFFFF,
                   0i64,
                   (__int64)v11,
                   0i64,
                   (PACCESS_STATE)a12,
                   (__int64)&a10,
                   0i64);
        if( Thread >= 0 )
        {
          _interlockedbittestandset((volatile signed __int32 *)&DmaAdapter[81], 0x14u);
          Thread = 0;
          v6 = (struct _EX_RUNDOWN_REF *)Object;
          *a3 = a10;
        }
      }
      else
      {
        Thread = -1073741558;
      }
    }
    else
    {
      Thread = -1073741816;
    }
  }
  if( DmaAdapter )
    HalPutDmaAdapter(DmaAdapter);
  if( v8 >= 2 )
    goto LABEL_17;
LABEL_18:
  if( (v8 & 1) != 0 )
    KeLeaveCriticalRegionThread((__int64)CurrentThread);
  if( v6 )
    ObfDereferenceObjectWithTag(v6, 0x72437350ui64);
  return(unsigned int)Thread;
}

Referenced by: