PspCreateThread

NTSTATUS __fastcall PspCreateThread(
        INT64 a1,
        INT64 a2,
        INT64 a3,
        VOID *a4,
        _EPROCESS *a5,
        INT64 a6,
        INT64 a7,
        INT64 a8,
        _QWORD *a9,
        CHAR a10,
        INT64 a11,
        INT64 a12,
        INT64 a13){
  _ETHREAD *CurrentThread; 
  char *v15; 
  char v16; 
  char *v17; 
  NTSTATUS Thread; 
  NTSTATUS v19; 
  INT64 v20; 
  __int64 v21; 
  NTSTATUS inserted; 
  struct _EX_RUNDOWN_REF *v23; 
  NTSTATUS v24; 
  int v25; 
  INT8 a3a; 
  char v27[12]; 
  int v28; 
  INT64 v29; 
  PADAPTER_OBJECT DmaAdapter; 
  PVOID Object; 
  INT64 a4a; 
  INT64 v33; 
  INT64 v34; 
  _QWORD *v35; 
  INT64 a2a; 
  __int64 v37; 
  __int64 v38; 
  INT64 v39; 
  __int128 v40; 
  INT64 result[50]; 
  *(_DWORD *)v27 = 0;
  a4a = a6;
  v37 = a7;
  v35 = a9;
  v29 = a11;
  v33 = a12;
  a2a = a3;
  v28 = a2;
  v38 = a1;
  v34 = a13;
  *(_QWORD *)&v27[4] = a8;
  memset((INT64)result, 0i64);
  v40 = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v15 = (char *)*((_QWORD *)CurrentThread + 23);
  if( a8 )
    v16 = *((_BYTE *)CurrentThread + 562);
  else
    v16 = 0;
  DmaAdapter = 0i64;
  v17 = 0i64;
  a3a = v16;
  Thread = -1073741816;
  Object = 0i64;
  if( a4 )
  {
    v19 = ObpReferenceObjectByHandleWithTag(
            (ULONG_PTR)a4,
            2,
            (__int64)PsProcessType,
            v16,
            0x72437350u,
            (__int64)&Object,
            0i64,
            0i64);
    v17 = (char *)Object;
    goto LABEL_5;
  }
  if( *(_QWORD *)&v27[4] )
  {
    v19 = -1073741816;
LABEL_5:
    if( v19 < 0 )
      return v19;
    goto LABEL_6;
  }
  ObfReferenceObjectWithTag(a5, 0x72437350u);
  v17 = (char *)a5;
LABEL_6:
  if( v17 != v15 && !PspIsProcessReadyForRemoteThread((INT64)v17) )
    return -1073741823;
  v20 = v29;
  if( v29 && *(_QWORD *)&v27[4] )
  {
    v20 = v29 & -(__int64)((v17[992] & 1) != 0);
    v29 = v20;
  }
  if( !a4a
    && !v20
    && ((*((_DWORD *)v17 + 628) & 1) != 0
     || (*((_DWORD *)v15 + 628) & 1) != 0
     || (*((_DWORD *)v17 + 629) & 0x4000) != 0
     || (*((_DWORD *)v15 + 629) & 0x4000) != 0) )
  {
    return -1073741790;
  }
  if( a3a )
  {
    v25 = *((_DWORD *)v17 + 543);
    if( (v25 & 0x1000) != 0 || (v25 & 1) != 0 )
    {
LABEL_31:
      ObfDereferenceObjectWithTag(v17, 0x72437350ui64);
      return Thread;
    }
  }
  if( (*((_DWORD *)v17 + 543) & 1) != 0 && !*((_QWORD *)v17 + 280) && *(_QWORD *)&v27[4] )
  {
    Thread = -1073741790;
    goto LABEL_31;
  }
  PspMapThreadCreationFlags((unsigned int)a10, (UINT64 *)v27);
  --*((_WORD *)CurrentThread + 242);
  if( !ExAcquireRundownProtection((PEX_RUNDOWN_REF)v17 + 139) )
  {
    KeLeaveCriticalRegionThread((__int64)CurrentThread);
    Thread = -1073741558;
    goto LABEL_31;
  }
  ObfReferenceObjectWithTag(v17, 0x72437350u);
  v21 = a4a;
  v39 = (INT64)v35;
  Thread = PspAllocateThread(
             (INT64)v17,
             a2a,
             a3a,
             a4a,
             *(INT32 **)&v27[4],
             (INT64)&v39,
             v29,
             v33,
             (INT64)v27,
             (INT64)&DmaAdapter,
             v34,
             (INT64)result);
  if( Thread < 0 )
  {
    ExReleaseRundownProtection((PEX_RUNDOWN_REF)v17 + 139);
    KeLeaveCriticalRegionThread((__int64)CurrentThread);
    goto LABEL_31;
  }
  ObfDereferenceObjectWithTag(v17, 0x72437350ui64);
  inserted = PspInsertThread(DmaAdapter, (ULONG_PTR)v17, v35, v27, v28, v34, v21, v33, (PACCESS_STATE)result, v38, v37);
  v23 = (struct _EX_RUNDOWN_REF *)(v17 + 1112);
  v24 = inserted;
  ExReleaseRundownProtection(v23);
  KeLeaveCriticalRegionThread((__int64)CurrentThread);
  HalPutDmaAdapter(DmaAdapter);
  return v24;
}

Referenced by: