ExpCheckThreadHistory

CHAR __fastcall ExpCheckThreadHistory(UINT64 *a1){
  char v1; 
  _ETHREAD *CurrentThread; 
  char v4; 
  char v5; 
  char i; 
  UINT64 v7; 
  int v8; 
  int v9; 
  char v11; 
  __int64 v12; 
  __int64 v13; 
  char j; 
  int v15; 
  char v16; 
  char v17; 
  __int128 v18[2]; 
  v1 = a1[39] & 7;
  memset(v18, 0, sizeof(v18));
  if( v1 == 4 )
    return 0;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v4 = 0;
  v5 = 0;
  for( i = 0; i < 4; ++i )
  {
    v7 = a1[i + 9];
    if( v7 )
    {
      if( (_ETHREAD *)v7 != CurrentThread && *(_BYTE *)(v7 + 388) == 5 )
      {
        v11 = *(_BYTE *)(v7 + 112) & 7;
        if( (v11 == 1 || v11 == 4) && *(_BYTE *)(v7 + 587) == 1 )
        {
          v12 = *(_QWORD *)(v7 + 352);
          if( v12 != *(_QWORD *)(a1[2] + 8) )
          {
            if( v11 == 4 || v12 == v7 + 736 )
              return 1;
            v13 = v5++;
            *((_QWORD *)v18 + v13) = v12;
          }
        }
      }
    }
  }
  v8 = v5;
  v9 = v5 - 3;
  if( v9 < 0 )
    return 0;
  for( j = 1; ; ++j )
  {
    v15 = j;
    v16 = 1;
    v17 = j;
    if( v8 - j >= 2 )
      break;
LABEL_20:
    ++v4;
    if( v15 > v9 )
      return 0;
  }
  while( *((_QWORD *)v18 + v4) != *((_QWORD *)v18 + v17) || ++v16 < 3 )
  {
    if( 3 - v16 > v8 - ++v17 )
      goto LABEL_20;
  }
  return 1;
}

Referenced by: