PsConvertToGuiThread

INT64 __fastcall PsConvertToGuiThread(){
  _ETHREAD *CurrentThread; 
  __int64 v1; 
  int v2; 
  int v3; 
  __int64 v4; 
  __int64 v5; 
  char v6; 
  INT64 result; 
  int v8; 
  INT64 v9; 
  INT64 v10; 
  int v11; 
  __int64 v12; 
  int v13; 
  int v14; 
  _ETHREAD *v15; 
  int v16; 
  int v17; 
  UINT8 SignatureLevel; 
  v14 = 0;
  v17 = 0;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  SignatureLevel = 0;
  if( !*((_BYTE *)CurrentThread + 562) )
    return 3221225485i64;
  if( (*((_DWORD *)CurrentThread + 30) & 0x80u) != 0 )
    return 1073741851i64;
  v1 = *((_QWORD *)CurrentThread + 23);
  v2 = *(_DWORD *)(v1 + 2512);
  if( (v2 & 0x1000) != 0 || (*(_DWORD *)(v1 + 2512) & 0x2000) != 0 )
  {
    EtwTimLogProhibitWin32kSystemCalls((unsigned int)((v2 & 0x1000) != 0) + 1, *((_QWORD *)CurrentThread + 23));
    if( (v2 & 0x1000) != 0 )
      return 3221225506i64;
  }
  v3 = 1;
  v12 = v1;
  v13 = 1;
  if( (int)PsQuerySectionSignatureInformation((_EPROCESS *)v1, &SignatureLevel) >= 0 )
  {
    v6 = (char)qword_140C1D900;
    if( qword_140C1D900 )
    {
      LOBYTE(v5) = SignatureLevel;
      LOBYTE(v4) = 12;
      v6 = qword_140C1D900(v5, v4);
      v3 = v13;
    }
    v13 = ((unsigned __int8)v3 ^ (unsigned __int8)(2 * v6)) & 2 ^ v3;
  }
  result = PsInvokeWin32Callout(0i64, &v12, 0i64, 0i64);
  if( (int)result >= 0 )
  {
    _interlockedbittestandset((volatile signed __int32 *)CurrentThread + 30, 7u);
    v8 = v2 & 0xC000;
    if( v8 )
      _interlockedbittestandset((volatile signed __int32 *)CurrentThread + 30, 0x15u);
    v16 = 0;
    v15 = CurrentThread;
    v11 = PsInvokeWin32Callout(1i64, &v15, 0i64, 0i64);
    if( v11 < 0 )
    {
      _interlockedbittestandreset((volatile signed __int32 *)CurrentThread + 30, 7u);
      if( v8 )
        _interlockedbittestandreset((volatile signed __int32 *)CurrentThread + 30, 0x15u);
    }
    SeCaptureAtomTableCallout(v10, v9);
    return(unsigned int)v11;
  }
  return result;
}

Referenced by: