NtGetNextThread

NTSTATUS __stdcall NtGetNextThread(
        VOID *ProcessHandle,
        VOID *ThreadHandle,
        UINT64 DesiredAccess,
        UINT64 HandleAttributes,
        UINT64 Flags,
        VOID **NewThreadHandle){
  int v6; 
  char PreviousMode; 
  __int64 v10; 
  NTSTATUS result; 
  int v12; 
  _ETHREAD *NextProcessThread; 
  _ETHREAD *CurrentThread; 
  _EPROCESS *v15; 
  VOID *v16; 
  UINT64 Tag; 
  UINT64 Taga; 
  _KPROCESSOR_MODE Object; 
  bool v20; 
  PVOID v21; 
  UINT64 DesiredAccessa; 
  PVOID v23; 
  VOID *Handle; 
  _ETHREAD *v25; 
  VOID **v26; 
  _ETHREAD *v27; 
  int v28[40]; 
  _AUX_ACCESS_DATA AuxData; 

  v6 = HandleAttributes;
  LODWORD(DesiredAccessa) = DesiredAccess;
  v26 = NewThreadHandle;
  v21 = 0i64;
  v23 = 0i64;
  memset(v28, 0i64, sizeof(v28));
  memset(&AuxData, 0i64, sizeof(AuxData));
  Handle = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( PreviousMode )
  {
    v10 = (__int64)NewThreadHandle;
    if( (unsigned __int64)NewThreadHandle >= 0x7FFFFFFF0000i64 )
      v10 = 0x7FFFFFFF0000i64;
    *(_QWORD *)v10 = *(_QWORD *)v10;
  }
  *NewThreadHandle = 0i64;
  if( (_DWORD)Flags )
    return -1073741811;
  LODWORD(Tag) = 1850045264;
  result = ObReferenceObjectByHandleWithTag(
             ProcessHandle,
             0x400ui64,
             (_OBJECT_TYPE *)PsProcessType,
             PreviousMode,
             Tag,
             &v21,
             0i64);
  if( result >= 0 )
  {
    if( ThreadHandle )
    {
      LODWORD(Taga) = 1850045264;
      v12 = ObReferenceObjectByHandleWithTag(
              ThreadHandle,
              0i64,
              (_OBJECT_TYPE *)PsThreadType,
              PreviousMode,
              Taga,
              &v23,
              0i64);
      if( v12 < 0 )
        goto LABEL_26;
      if( *((PVOID *)v23 + 68) != v21 )
      {
        ObfDereferenceObjectWithTag(v23, 0x6E457350ui64);
        v12 = -1073741811;
        goto LABEL_26;
      }
    }
    NextProcessThread = (_ETHREAD *)PsGetNextProcessThread((_EPROCESS *)v21, (_ETHREAD *)v23);
    v25 = NextProcessThread;
    if( NextProcessThread )
    {
      v20 = SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, PreviousMode) != 0;
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      v27 = CurrentThread;
      v15 = (_EPROCESS *)v21;
      do
      {
        if( (NextProcessThread->CrossThreadFlags & 2) != 0
          || (PsSynchronizeWithThreadInsertion(NextProcessThread, CurrentThread),
              (NextProcessThread->CrossThreadFlags & 2) != 0) )
        {
          v12 = SeCreateAccessState(
                  (_ACCESS_STATE *)v28,
                  &AuxData,
                  (unsigned int)DesiredAccessa,
                  (_GENERIC_MAPPING *)((char *)PsProcessType + 76));
          if( v12 < 0 )
            goto LABEL_20;
          if( v20 )
          {
            if( (v28[4] & 0x2000000) != 0 )
              v28[5] |= 0x1FFFFFu;
            else
              v28[5] |= v28[4];
            v28[4] = 0;
          }
          LOBYTE(Object) = PreviousMode;
          v12 = ObOpenObjectByPointer(
                  NextProcessThread,
                  v6 & (PreviousMode != 0 ? 7666 : 73714),
                  (PACCESS_STATE)v28,
                  0,
                  (POBJECT_TYPE)PsThreadType,
                  Object,
                  &Handle);
          SeDeleteAccessState((_ACCESS_STATE *)v28);
          if( v12 >= 0 )
          {
            *v26 = Handle;
            goto LABEL_20;
          }
          if( v12 != -1073741790 )
            goto LABEL_20;
        }
        NextProcessThread = (_ETHREAD *)PsGetNextProcessThread(v15, NextProcessThread);
        v25 = NextProcessThread;
        CurrentThread = v27;
      }
      while( NextProcessThread );
      v12 = -2147483622;
LABEL_20:
      ObfDereferenceObjectWithTag(v15, 0x6E457350ui64);
      if( !NextProcessThread )
        return v12;
      v16 = NextProcessThread;
LABEL_22:
      ObfDereferenceObjectWithTag(v16, 0x6E457350ui64);
      return v12;
    }
    v12 = -2147483622;
LABEL_26:
    v16 = v21;
    goto LABEL_22;
  }
  return result;
}

Referenced by: