ExpDebuggerWorker

VOID __stdcall ExpDebuggerWorker(VOID *Context){
  _LIST_ENTRY *v1; 
  _LIST_ENTRY *v2; 
  char v3; 
  char DefaultPagePriority; 
  unsigned int v5; 
  _ETHREAD *v6; 
  VOID *v7; 
  _EPROCESS *v8; 
  _LIST_ENTRY *NextProcess; 
  _LIST_ENTRY *v10; 
  __int64 v11; 
  NTSTATUS v12; 
  VOID *VirtualAddress; 
  __int64 v14; 
  _KAPC_STATE ApcState; 

  v1 = (_LIST_ENTRY *)*(&WheapDeferredInternalLogsEventLock + 314);
  v2 = (_LIST_ENTRY *)*(&WheapDeferredInternalLogsEventLock + 313);
  v3 = *(&ExBootDevicesRemovedEvent + 3016);
  memset(&ApcState, 0, sizeof(ApcState));
  DefaultPagePriority = MmGetDefaultPagePriority();
  VirtualAddress = (VOID *)*(&WheapDeferredInternalLogsEventLock + 336);
  v14 = 1i64;
  *(&WheapDeferredInternalLogsEventLock + 313) = 0i64;
  v5 = DefaultPagePriority & 7 | 0xB8;
  *(&WheapDeferredInternalLogsEventLock + 314) = 0i64;
  *(&WheapDeferredInternalLogsEventLock + 336) = 0i64;
  _InterlockedExchange(&ExpDebuggerWork, 0);
  MmDbgMarkPfnModifiedWorker();
  v6 = 0i64;
  if( v1 || v2 )
  {
    v8 = 0i64;
    while( 1 )
    {
      NextProcess = PsGetNextProcess(v8);
      v6 = (_ETHREAD *)NextProcess;
      if( !NextProcess )
        break;
      if( NextProcess == v1 )
      {
        KiStackAttachProcess(v1, 0i64, &ApcState);
        if( v6 )
          goto LABEL_3;
        break;
      }
      v8 = (_EPROCESS *)NextProcess;
      if( NextProcess == v2 )
      {
        PsTerminateProcess((ULONG_PTR)NextProcess, 0x40010004ui64);
        goto LABEL_30;
      }
    }
    v10 = v2;
    if( v1 )
      v10 = v1;
    DbgPrintEx(
      0,
      0,
      "EX debug work: Unable to find process %p\n",
      v10,
      VirtualAddress,
      v14,
      ApcState.ApcListHead[0].Flink,
      ApcState.ApcListHead[0].Blink,
      ApcState.ApcListHead[1].Flink,
      ApcState.ApcListHead[1].Blink,
      ApcState.Process,
      *(_QWORD *)&ApcState.InProgressFlags);
  }
LABEL_3:
  v7 = VirtualAddress;
  if( VirtualAddress )
  {
    if( MmIsSessionAddress(VirtualAddress) )
      v11 = -3i64;
    else
      v11 = -(__int64)((unsigned __int64)VirtualAddress < 0xFFFF800000000000ui64);
    v12 = MmPrefetchVirtualMemory((CHAR *)v11, 1ui64, (INT64)&VirtualAddress, v5);
    if( v12 < 0 )
      DbgPrintEx(0, 0, "EX page in: MmPrefetchVirtualMemory failed, 0x%08x\n", (unsigned int)v12);
    v7 = VirtualAddress;
  }
  if( v3 )
  {
    EtwWmitraceWorker();
    v7 = VirtualAddress;
  }
  if( v1 || v2 || v7 || v3 )
    DbgBreakPointWithStatus(7u);
  if( v6 )
  {
    KiUnstackDetachProcess(&ApcState, 0i64);
LABEL_30:
    PsQuitNextProcessThread(v6);
  }
}

Referenced by: