DbgkSendSystemDllMessages

VOID __stdcall DbgkSendSystemDllMessages(VOID *SendingThread, _KEVENT *TargetDebugObject, _DBGKM_APIMSG *DbgMsg){
  _ETHREAD *v4; 
  _EPROCESS *Process; 
  _DBGKM_APIMSG *v6; 
  int i; 
  _PS_SYSTEM_DLL_INFO *SystemDllInfo; 
  _PS_SYSTEM_DLL_INFO *v9; 
  UINT64 v10; 
  __int64 v11; 
  _ETHREAD *CurrentThread; 
  int v13; 
  UINT64 ShareAccess; 
  UINT64 OpenOptions; 
  char v16; 
  WCHAR *Teb; 
  _PS_SYSTEM_DLL_INFO *v19; 
  int v20; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  _KAPC_STATE ApcState; 

  v4 = (_ETHREAD *)SendingThread;
  v20 = HIDWORD(TargetDebugObject);
  memset(&ApcState, 0, sizeof(ApcState));
  IoStatusBlock = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  if( SendingThread )
    Process = (_EPROCESS *)*((_QWORD *)SendingThread + 68);
  else
    Process = KeGetCurrentThread()->ApcState.Process;
  v6 = DbgMsg + 12;
  for( i = 0; i < 6; ++i )
  {
    SystemDllInfo = PsQuerySystemDllInfo((_SYSTEM_DLL_TYPE)i);
    v9 = SystemDllInfo;
    v19 = SystemDllInfo;
    if( SystemDllInfo
      && (i <= 0
       || *((_WORD *)SystemDllInfo + 1) && Process->WoW64Process && i == PsWow64GetProcessNtdllType((INT64)Process)) )
    {
      *(_OWORD *)v6 = 0i64;
      *((_OWORD *)v6 + 1) = 0i64;
      Teb = 0i64;
      v10 = *((_QWORD *)v9 + 3);
      *((_QWORD *)v6 + 1) = v10;
      if( v4 && i )
      {
        v16 = 1;
        KiStackAttachProcess(Process, 0i64, &ApcState);
      }
      else
      {
        v16 = 0;
      }
      LODWORD(v11) = RtlImageNtHeader(v10);
      if( v11 )
      {
        v6[4] = *(_DWORD *)(v11 + 12);
        v6[5] = *(_DWORD *)(v11 + 16);
      }
      if( !v4 )
      {
        CurrentThread = (_ETHREAD *)KeGetCurrentThread();
        if( (CurrentThread->Tcb._bf_0 & 0x400) != 0 || CurrentThread->Tcb.ApcStateIndex == 1 )
          Teb = 0i64;
        else
          Teb = (WCHAR *)CurrentThread->Tcb.Teb;
        if( Teb )
        {
          RtlStringCbCopyW(Teb + 2356, 0x20Aui64, *((WCHAR **)v19 + 5));
          *((_QWORD *)Teb + 5) = Teb + 2356;
          *((_QWORD *)v6 + 3) = Teb + 20;
          v4 = (_ETHREAD *)SendingThread;
        }
      }
      if( v16 )
        KiUnstackDetachProcess(&ApcState, 0i64);
      ObjectAttributes.Length = 48;
      ObjectAttributes.RootDirectory = 0i64;
      ObjectAttributes.Attributes = 1600;
      ObjectAttributes.ObjectName = (_UNICODE_STRING *)(v19 + 2);
      *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
      LODWORD(OpenOptions) = 32;
      LODWORD(ShareAccess) = 7;
      if( ZwOpenFile((VOID **)v6, 0x80100000ui64, &ObjectAttributes, &IoStatusBlock, ShareAccess, OpenOptions) < 0 )
        *(_QWORD *)v6 = 0i64;
      *DbgMsg = 5242920;
      DbgMsg[1] = 8;
      DbgMsg[10] = 5;
      if( v4 )
      {
        HIDWORD(ShareAccess) = v20;
        DbgkpQueueMessage(Process, v4);
        if( v13 < 0 && *(_QWORD *)v6 )
          ObCloseHandle(*(VOID **)v6, 0);
      }
      else
      {
        DbgkpSendApiMessage(Process, 3ui64, DbgMsg);
        if( *(_QWORD *)v6 )
          ObCloseHandle(*(VOID **)v6, 0);
        if( Teb )
          *((_QWORD *)Teb + 5) = 0i64;
      }
    }
  }
}

Referenced by: