NtQueryInformationWorkerFactory

INT64 __fastcall NtQueryInformationWorkerFactory(
        VOID *WorkerFactoryHandle,
        INT64 WorkerFactoryInformationClass,
        VOID *WorkerFactoryInformation,
        UINT64 WorkerFactoryInformationLength,
        UINT64 *ReturnLength,
        INT64 a6,
        INT64 a7,
        INT64 a8){
  int v8; 
  KPROCESSOR_MODE v11; 
  INT64 result; 
  __int64 v13; 
  __int64 v14; 
  char *v15; 
  __int64 v16; 
  int v17; 
  PVOID Object; 
  __int128 v19; 
  __int128 v20; 
  __int128 v21; 
  __int128 v22; 
  __int128 v23; 
  __int128 v24; 
  __int128 v25; 
  __int64 v26; 
  struct _KLOCK_QUEUE_HANDLE LockHandle; 
  v8 = WorkerFactoryInformationLength;
  memset(&LockHandle, 0, sizeof(LockHandle));
  v11 = *((_BYTE *)KeGetCurrentThread() + 562);
  if( (_DWORD)WorkerFactoryInformationClass != 7 )
    return 3221225475i64;
  if( v11 )
  {
    if( ((unsigned __int8)WorkerFactoryInformation & 3) != 0 )
      ExRaiseDatatypeMisalignment();
    v13 = 0x7FFFFFFF0000i64;
    v14 = 0x7FFFFFFF0000i64;
    if( (unsigned __int64)WorkerFactoryInformation < 0x7FFFFFFF0000i64 )
      v14 = (__int64)WorkerFactoryInformation;
    *(_BYTE *)v14 = *(_BYTE *)v14;
    *(_BYTE *)(v14 + 119) = *(_BYTE *)(v14 + 119);
    if( ReturnLength )
    {
      if( (unsigned __int64)ReturnLength < 0x7FFFFFFF0000i64 )
        v13 = (__int64)ReturnLength;
      *(_DWORD *)v13 = 120;
    }
  }
  else if( ReturnLength )
  {
    *(_DWORD *)ReturnLength = 120;
  }
  if( v8 != 120 )
    return 3221225476i64;
  Object = 0i64;
  LODWORD(result) = ObReferenceObjectByHandle(WorkerFactoryHandle, 8u, ExpWorkerFactoryObjectType, v11, &Object, 0i64);
  if( (int)result >= 0 )
  {
    HIBYTE(v20) = 0;
    HIDWORD(v22) = 0;
    HIDWORD(v26) = 0;
    v15 = (char *)Object;
    KeAcquireInStackQueuedSpinLock(*((UINT64 **)Object + 2), &LockHandle);
    v19 = 0i64;
    *(_QWORD *)&v20 = *((_QWORD *)v15 + 14);
    WORD4(v20) = 0;
    BYTE10(v20) = (v15[312] & 8) != 0;
    v16 = *((_QWORD *)v15 + 2);
    v17 = *(_DWORD *)(v16 + 28);
    BYTE11(v20) = v17 == 0;
    BYTE12(v20) = *((_DWORD *)v15 + 76) != 0;
    *(_WORD *)((char *)&v20 + 13) = *(_WORD *)(v16 + 32);
    LODWORD(v21) = *((_DWORD *)v15 + 77);
    *(_QWORD *)((char *)&v21 + 4) = *((_QWORD *)v15 + 35);
    HIDWORD(v21) = *((_DWORD *)v15 + 74);
    LODWORD(v22) = v17;
    DWORD1(v22) = *((_DWORD *)v15 + 73);
    DWORD2(v22) = *(_DWORD *)(v16 + 24);
    *(_QWORD *)&v23 = 0i64;
    *((_QWORD *)&v23 + 1) = *((_QWORD *)v15 + 3);
    *(_QWORD *)&v24 = *((_QWORD *)v15 + 4);
    *((_QWORD *)&v24 + 1) = *(_QWORD *)(*((_QWORD *)v15 + 6) + 1088i64);
    v25 = *(_OWORD *)(v15 + 56);
    LODWORD(v26) = *((_DWORD *)v15 + 80);
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
    __writecr8(LockHandle.OldIrql);
    ObfDereferenceObjectWithTag(v15, 0x746C6644ui64);
    *(_OWORD *)WorkerFactoryInformation = v19;
    *((_OWORD *)WorkerFactoryInformation + 1) = v20;
    *((_OWORD *)WorkerFactoryInformation + 2) = v21;
    *((_OWORD *)WorkerFactoryInformation + 3) = v22;
    *((_OWORD *)WorkerFactoryInformation + 4) = v23;
    *((_OWORD *)WorkerFactoryInformation + 5) = v24;
    *((_OWORD *)WorkerFactoryInformation + 6) = v25;
    *((_QWORD *)WorkerFactoryInformation + 14) = v26;
    return 0i64;
  }
  return result;
}

Referenced by: