PspThreadDelete

VOID __fastcall PspThreadDelete(VOID *Object){
  VOID *v2; 
  char *v3; 
  _KERNEL_STACK_SEGMENT *v4; 
  _ETHREAD *CurrentThread; 
  _HANDLE_TABLE_ENTRY *v6; 
  void *v7; 
  __int64 v8; 
  unsigned __int64 v9; 
  char *v10; 
  __int64 v11; 
  __int64 v12; 
  int v13; 
  _QWORD *v14; 
  char *v15; 
  __int64 v16; 
  __int64 v17; 
  _EX_PUSH_LOCK *v18; 
  char *v19; 
  __int64 v20; 
  char **v21; 
  VOID *BugCheckParameter4; 
  VOID *v23; 
  void *v24; 

  KeCleanupThreadState((_KTHREAD *)Object);
  if( *((_DWORD *)Object + 343) )
    KeBugCheckEx(0x94u, (PVOID)1, Object, (PVOID)*((unsigned int *)Object + 343), 0i64);
  if( *((_DWORD *)Object + 340) )
    KeBugCheckEx(0x13Cu, Object, (PVOID)*((unsigned int *)Object + 340), 0i64, 0i64);
  if( *((_DWORD *)Object + 341) )
    KeBugCheckEx(0x13Cu, Object, (PVOID)*((unsigned int *)Object + 341), (PVOID)1, 0i64);
  if( *((_DWORD *)Object + 342) )
    KeBugCheckEx(0x13Cu, Object, (PVOID)*((unsigned int *)Object + 342), (PVOID)2, 0i64);
  v3 = (char *)*((_QWORD *)Object + 197);
  if( v3 != (char *)Object + 1576 )
    KeBugCheckEx(0x1C6u, (PVOID)0x14, Object, v3, 0i64);
  v4 = (_KERNEL_STACK_SEGMENT *)*((_QWORD *)Object + 200);
  if( v4 != (_KERNEL_STACK_SEGMENT *)((char *)Object + 1600) )
    KeBugCheckEx(0x1C6u, (PVOID)0x15, Object, v4, 0i64);
  if( *((_QWORD *)Object + 5) )
    KeEnumerateKernelStackSegments((_ETHREAD *)Object, PspDeleteKernelStack, 0i64, v4, BugCheckParameter4, v23);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  if( *((_QWORD *)Object + 144) )
  {
    --CurrentThread->Tcb.KernelApcDisable;
    v6 = ExMapHandleToPointer(PspCidTable, *((VOID **)Object + 144), v2, (INT64)v4, BugCheckParameter4, (INT64)v23, v24);
    if( !v6 )
      KeBugCheck(0x17u);
    ExDestroyHandle(PspCidTable, *((VOID **)Object + 144), v6);
    KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
  }
  PspDeleteThreadSecurity((_ETHREAD *)Object);
  v7 = (void *)*((_QWORD *)Object + 194);
  if( v7 )
    ExFreePoolWithTag(v7, 0x6D4E6854u);
  if( KiQueryUnbiasedInterruptTime(1u) >= qword_140C4C3B0 )
  {
    v8 = qword_140C4C3A0;
    if( qword_140C4C3A0 )
    {
      if( (_DWORD)qword_140C4C3B8 )
      {
        v9 = 0i64;
        v10 = (char *)&stru_140C23628 + 6712;
        v11 = (unsigned int)qword_140C4C3B8;
        do
        {
          v12 = *(_QWORD *)v10;
          if( ((*(unsigned __int8 *)(*(_QWORD *)v10 + 66i64) >> 6) & 1) != _bittest64(&qword_140C4C3C0, v9)
            && !qword_140C4C370 )
          {
            qword_140C4C370 = (unsigned int)__ROL4__(1207959560, 133);
            xmmword_140C4C378 = 0i64;
            qword_140C4C388 = 268i64;
            qword_140C4C390 = v12;
          }
          ++v9;
          v10 += 8;
          --v11;
        }
        while( v11 );
        v8 = qword_140C4C3A0;
      }
      v13 = 64;
      v14 = (_QWORD *)(qword_140C4C3E0 + 112);
      v15 = (char *)(qword_140C4C3E0 + 112);
      if( qword_140C4C3E0 + 112 < (unsigned __int64)(qword_140C4C3E0 + 176) )
      {
        do
        {
          _mm_prefetchnta(v15);
          v15 += 64;
        }
        while( (unsigned __int64)v15 < qword_140C4C3E0 + 176 );
      }
      v16 = 8i64;
      do
      {
        v8 = __ROR8__(v8 - *v14++, qword_140C4C3A8);
        v13 -= 8;
        --v16;
      }
      while( v16 );
      for( ; v13; --v13 )
      {
        v17 = *(unsigned __int8 *)v14;
        v14 = (_QWORD *)((char *)v14 + 1);
        v8 = __ROR8__(v8 - v17, qword_140C4C3A8);
      }
      if( qword_140C4C3E8 != v8 )
      {
        if( qword_140C4C370 )
          goto LABEL_45;
        qword_140C4C370 = (unsigned int)__ROR4__(150994945, 152);
        xmmword_140C4C378 = 0i64;
        qword_140C4C388 = 268i64;
        qword_140C4C390 = qword_140C4C3E0;
      }
    }
    if( !qword_140C4C370 )
    {
LABEL_31:
      qword_140C4C3B0 = KiQueryUnbiasedInterruptTime(1u)
                      + 41929663 * (__rdtsc() >> 4) % 0x12A05F2000i64
                      + 288000000000i64;
      goto LABEL_32;
    }
LABEL_45:
    if( (VOID(__stdcall *)(_KDPC *, PVOID, PVOID, PVOID))stru_140C4C330.DeferredRoutine != KiScanQueues )
      KeInitializeDpc(&stru_140C4C330, KiScanQueues, &stru_140C4C330);
    qword_140C4C398 = 1934400i64;
    KeInsertQueueDpc((UINT64)&stru_140C4C330, 0i64, 0i64);
    goto LABEL_31;
  }
LABEL_32:
  v18 = (_EX_PUSH_LOCK *)*((_QWORD *)Object + 68);
  if( v18 )
  {
    v19 = (char *)Object + 1256;
    if( *((_QWORD *)Object + 157) )
    {
      --CurrentThread->Tcb.KernelApcDisable;
      ExAcquirePushLockExclusiveEx(v18 + 135, 0i64);
      ExAcquirePushLockExclusiveEx(v18 + 268, 0i64);
      KeFoldProcessStatisticsThread((_KTHREAD *)Object);
      v20 = *(_QWORD *)v19;
      if( *(char **)(*(_QWORD *)v19 + 8i64) != v19 || (v21 = (char **)*((_QWORD *)Object + 158), *v21 != v19) )
        __fastfail(3u);
      *v21 = (char *)v20;
      *(_QWORD *)(v20 + 8) = v21;
      if( (_InterlockedExchangeAdd64(&v18[268]._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock(v18 + 268);
      KeAbPostRelease(&v18[268]);
      if( (_InterlockedExchangeAdd64(&v18[135]._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock(v18 + 135);
      KeAbPostRelease(&v18[135]);
      KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
    }
    if( (*((_DWORD *)Object + 324) & 0x100000) != 0 )
      ((void(__fastcall *)(VOID *))xmmword_140C1DE50)(Object);
    ObfDereferenceObjectWithTag(v18, 0x72437350ui64);
  }
}

Referenced by: