NtCreateThread

VOID __stdcall NtCreateThread(){
  unsigned int v0; 
  _QWORD *v1; 
  INT64 v2; 
  VOID *v3; 
  VOID *v4; 
  INT64 v5; 
  unsigned int v6; 
  _QWORD *v7; 
  char *v8; 
  INT8 v9; 
  __int64 v10; 
  __int64 v11; 
  char *v12; 
  __int64 v13; 
  __int128 v14; 
  __int64 v15; 
  __int16 v16; 
  char *a8; 
  INT64 result[2]; 
  __int128 v19; 
  PVOID AllocatedStackBase; 
  __int128 v21; 
  PVOID v22; 
  _ETHREAD *CurrentThread; 
  _ETHREAD *v24; 
  INT64 a13[2]; 
  __int128 v26; 
  char v27[152]; 
  unsigned __int64 v28; 
  unsigned __int64 ClientId; 
  char *ThreadContext; 
  PINITIAL_TEB UserStack; 
  BOOLEAN CreateSuspended; 
  v4 = v3;
  v5 = v2;
  v6 = v0;
  v7 = v1;
  v8 = ThreadContext;
  memset((INT64)result, 0i64);
  *(_OWORD *)a13 = 0i64;
  v26 = 0i64;
  if( !ThreadContext )
    return;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v9 = *((_BYTE *)CurrentThread + 562);
  if( !v9 )
  {
    a8 = ThreadContext;
    goto LABEL_17;
  }
  v10 = (__int64)v7;
  if( (unsigned __int64)v7 >= 0x7FFFFFFF0000i64 )
    v10 = 0x7FFFFFFF0000i64;
  *(_QWORD *)v10 = *(_QWORD *)v10;
  if( ClientId )
  {
    if( (ClientId & 3) != 0 )
      goto LABEL_15;
    v11 = ClientId;
    if( ClientId >= 0x7FFFFFFF0000i64 )
      v11 = 0x7FFFFFFF0000i64;
    *(_BYTE *)v11 = *(_BYTE *)v11;
    *(_BYTE *)(v11 + 15) = *(_BYTE *)(v11 + 15);
  }
  if( ((unsigned __int8)ThreadContext & 0xF) != 0 )
    goto LABEL_15;
  v12 = v27;
  v13 = 9i64;
  do
  {
    *(_OWORD *)v12 = *(_OWORD *)v8;
    *((_OWORD *)v12 + 1) = *((_OWORD *)v8 + 1);
    *((_OWORD *)v12 + 2) = *((_OWORD *)v8 + 2);
    *((_OWORD *)v12 + 3) = *((_OWORD *)v8 + 3);
    *((_OWORD *)v12 + 4) = *((_OWORD *)v8 + 4);
    *((_OWORD *)v12 + 5) = *((_OWORD *)v8 + 5);
    *((_OWORD *)v12 + 6) = *((_OWORD *)v8 + 6);
    v12 += 128;
    *((_OWORD *)v12 - 1) = *((_OWORD *)v8 + 7);
    v8 += 128;
    --v13;
  }
  while( v13 );
  *(_OWORD *)v12 = *(_OWORD *)v8;
  *((_OWORD *)v12 + 1) = *((_OWORD *)v8 + 1);
  *((_OWORD *)v12 + 2) = *((_OWORD *)v8 + 2);
  *((_OWORD *)v12 + 3) = *((_OWORD *)v8 + 3);
  *((_OWORD *)v12 + 4) = *((_OWORD *)v8 + 4);
  a8 = v27;
  v28 = (v28 & 0xFFFFFFFFFFFFFFF0ui64) - 40;
  if( ((unsigned __int8)UserStack & 3) != 0 )
LABEL_15:
    ExRaiseDatatypeMisalignment();
  v8 = v27;
LABEL_17:
  if( RtlpSanitizeContextFlags((UINT64 *)v8 + 6, v9) >= 0 )
  {
    *((_DWORD *)v8 + 12) &= 0x10001Fu;
    *v7 = 0i64;
    v14 = *(_OWORD *)&UserStack->PreviousStackBase;
    *(_OWORD *)result = v14;
    if( !(_QWORD)v14 && !result[1] )
    {
      *(_OWORD *)result = v14;
      v19 = *(_OWORD *)&UserStack->StackBase;
      AllocatedStackBase = UserStack->AllocatedStackBase;
      if( AllocatedStackBase )
      {
        v24 = (_ETHREAD *)KeGetCurrentThread();
        v15 = *(_QWORD *)(*((_QWORD *)v24 + 23) + 1408i64);
        if( v15 )
        {
          v16 = *(_WORD *)(v15 + 8);
          if( v16 == 332 || v16 == 452 )
          {
            v22 = AllocatedStackBase;
            v21 = v19;
            AllocatedStackBase = 0i64;
            v19 = 0i64;
          }
        }
        LOBYTE(a13[0]) = 1;
        PspCreateThread(
          (INT64)v7,
          v6,
          v5,
          v4,
          0i64,
          0i64,
          ClientId,
          (INT64)a8,
          result,
          CreateSuspended == 1,
          0i64,
          0i64,
          (INT64)a13);
      }
    }
  }
}

Referenced by: