NtCreateThreadEx

NTSTATUS __fastcall NtCreateThreadEx(
        UINT64 a1,
        INT64 a2,
        INT64 a3,
        VOID *a4,
        INT64 a5,
        INT64 a6,
        INT64 a7,
        INT64 a8,
        INT64 a9,
        INT64 a10,
        UINT64 *a11){
  NTSTATUS ProcessContext; 
  UINT64 v14; 
  unsigned int v15; 
  unsigned __int64 v16; 
  void *v17; 
  INT64 a12; 
  NTSTATUS Thread; 
  UINT64 v20; 
  unsigned int a2a; 
  unsigned int a2_4; 
  PVOID Object; 
  __int64 v24; 
  INT64 v25; 
  INT64 a3a; 
  __int64 result[10]; 
  INT64 v28[66]; 
  char a13; 
  int v30; 
  __int16 v31; 
  char v32; 
  INT64 v33; 
  INT64 v34; 
  INT64 v35; 
  a3a = a3;
  a2_4 = a2;
  v25 = a6;
  memset((INT64)result, 0i64);
  Object = 0i64;
  v30 = 0;
  v31 = 0;
  v32 = 0;
  v24 = 0i64;
  a2a = 0;
  if( (a7 & 0xFFFFFF80) != 0 )
    return -1073741579;
  if( *((_BYTE *)KeGetCurrentThread() + 562) )
  {
    v20 = a1;
    if( a1 >= 0x7FFFFFFF0000i64 )
      v20 = 0x7FFFFFFF0000i64;
    *(_QWORD *)v20 = *(_QWORD *)v20;
  }
  a13 = 0;
  v34 = a9;
  v35 = a10;
  v33 = a8;
  memset((INT64)v28, 0i64);
  if( !a11
    || (ProcessContext = PspBuildCreateProcessContext(a11, *((_BYTE *)KeGetCurrentThread() + 562), 1i64, (INT64)v28),
        ProcessContext >= 0) )
  {
    ProcessContext = ObpReferenceObjectByHandleWithTag(
                       (ULONG_PTR)a4,
                       2,
                       (__int64)PsProcessType,
                       *((_BYTE *)KeGetCurrentThread() + 562),
                       0x72437350u,
                       (__int64)&Object,
                       0i64,
                       0i64);
    if( ProcessContext >= 0 )
    {
      v14 = (*((_DWORD *)Object + 629) & 0x4000) != 0 ? 0x800 : 0;
      v15 = (*((_DWORD *)Object + 629) & 0x4000) != 0 ? 1048651 : 1048587;
      ObfDereferenceObjectWithTag(Object, 0x72437350ui64);
      RtlGetExtendedContextLength2(v15, &a2a, (unsigned int)v14);
      v16 = a2a + 15i64;
      if( v16 <= a2a )
        v16 = 0xFFFFFFFFFFFFFF0i64;
      v17 = alloca(v16 & 0xFFFFFFFFFFFFFFF0ui64);
      memset((INT64)&a2a, 0i64);
      RtlInitializeExtendedContext2((INT64)&a2a, v15, &v24, v14);
      PspCreateUserContext((INT64)&a2a, 1, PspUserThreadStart, a5, v25);
      Thread = PspCreateThread(
                 a1,
                 a2_4,
                 a3a,
                 a4,
                 0i64,
                 (INT64)v28,
                 v28[2],
                 (INT64)&a2a,
                 result,
                 a7,
                 a5,
                 a12,
                 (INT64)&a13);
      PspDeleteCreateProcessContext((INT64)v28);
      return Thread;
    }
  }
  return ProcessContext;
}

Referenced by: