DbgkUserReportWorkRoutine

NTSTATUS __stdcall DbgkUserReportWorkRoutine(PVOID P){
  _ETHREAD *v2; 
  PEPROCESS v3; 
  NTSTATUS v4; 
  char *v5; 
  NTSTATUS result; 
  _OBJECT_TYPE *ObjectType; 
  _KPROCESSOR_MODE AccessMode; 
  UINT64 AccessModea; 
  VOID **Handle; 
  VOID *BaseAddress; 
  VOID *ThreadHandle; 
  VOID *v13; 
  UINT64 RegionSize[3]; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  _KAPC_STATE ApcState; 

  RegionSize[2] = (UINT64)P;
  v13 = 0i64;
  ThreadHandle = 0i64;
  BaseAddress = 0i64;
  RegionSize[0] = 168i64;
  memset(&ApcState, 0, sizeof(ApcState));
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  v2 = *(_ETHREAD **)P;
  RegionSize[1] = (UINT64)v2;
  v3 = IoThreadToProcess(v2);
  KiStackAttachProcess(v3, 0i64, &ApcState);
  LOBYTE(AccessMode) = 1;
  v4 = ObOpenObjectByPointer(v2, 0i64, 0i64, 114, (POBJECT_TYPE)PsThreadType, AccessMode, &v13);
  if( v4 >= 0 )
  {
    LODWORD(AccessModea) = 4;
    LODWORD(ObjectType) = 12288;
    v4 = ZwAllocateVirtualMemory(
           (VOID *)0xFFFFFFFFFFFFFFFFi64,
           &BaseAddress,
           0i64,
           RegionSize,
           (UINT64)ObjectType,
           AccessModea);
    if( v4 >= 0 )
    {
      *((_QWORD *)BaseAddress + 1) = *((_QWORD *)P + 1);
      *(_QWORD *)BaseAddress = v13;
      if( *((_BYTE *)P + 16) )
      {
        v5 = (char *)BaseAddress + 16;
        *((_OWORD *)BaseAddress + 1) = *(_OWORD *)((char *)P + 24);
        *((_OWORD *)v5 + 1) = *(_OWORD *)((char *)P + 40);
        *((_OWORD *)v5 + 2) = *(_OWORD *)((char *)P + 56);
        *((_OWORD *)v5 + 3) = *(_OWORD *)((char *)P + 72);
        *((_OWORD *)v5 + 4) = *(_OWORD *)((char *)P + 88);
        *((_OWORD *)v5 + 5) = *(_OWORD *)((char *)P + 104);
        *((_OWORD *)v5 + 6) = *(_OWORD *)((char *)P + 120);
        *((_OWORD *)v5 + 7) = *(_OWORD *)((char *)P + 136);
        *((_OWORD *)v5 + 8) = *(_OWORD *)((char *)P + 152);
        *((_QWORD *)v5 + 18) = *((_QWORD *)P + 21);
      }
      ObjectAttributes.Length = 48;
      ObjectAttributes.RootDirectory = 0i64;
      ObjectAttributes.Attributes = 512;
      ObjectAttributes.ObjectName = 0i64;
      *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
      LODWORD(Handle) = 39;
      v4 = ZwCreateThreadEx(
             &ThreadHandle,
             0x1FFFFFui64,
             &ObjectAttributes,
             (VOID *)0xFFFFFFFFFFFFFFFFi64,
             (VOID *)DbgkWerReportExceptionWorker,
             BaseAddress,
             (UINT64)Handle,
             0i64,
             0i64,
             0i64,
             0i64);
    }
    else
    {
      BaseAddress = 0i64;
    }
  }
  if( v4 < 0 )
  {
    _InterlockedAnd((volatile signed __int32 *)&v2->1296, 0xFFDFFFFF);
    if( v13 )
      ObCloseHandle(v13, 1);
    PsResumeThread(v2, 0i64);
    if( BaseAddress )
      ZwFreeVirtualMemory((VOID *)0xFFFFFFFFFFFFFFFFi64, &BaseAddress, 0i64, 0x8000ui64);
  }
  else
  {
    ZwSetInformationThread((UINT64)ThreadHandle, 46i64, (UINT64)&qword_140033510, 4ui64);
    ZwResumeThread(ThreadHandle, 0i64);
    ZwClose((_HANDLE)ThreadHandle);
    ThreadHandle = 0i64;
  }
  KiUnstackDetachProcess(&ApcState, 0i64);
  ExFreePoolWithTag(P, 0x4B474244u);
  HalPutDmaAdapter((PADAPTER_OBJECT)v2);
  return result;
}

Referenced by: