NtSetContextThread

NTSTATUS __stdcall NtSetContextThread(VOID *ThreadHandle, _CONTEXT *ThreadContext){
  _ETHREAD *CurrentThread; 
  INT8 PreviousMode; 
  int v5; 
  PEPROCESS v6; 
  PETHREAD v7; 
  int v9; 
  PETHREAD Thread; 
  _EVENT_DATA_DESCRIPTOR UserData; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  Thread = 0i64;
  PreviousMode = CurrentThread->Tcb.PreviousMode;
  v5 = ObReferenceObjectByHandle(
         ThreadHandle,
         0x10ui64,
         (_OBJECT_TYPE *)PsThreadType,
         PreviousMode,
         (VOID **)&Thread,
         0i64);
  if( v5 >= 0 )
  {
    v6 = IoThreadToProcess(CurrentThread);
    v7 = Thread;
    if( (v6->Flags2 & 0x20000) != 0 && v6 == IoThreadToProcess(Thread) )
    {
      v5 = -1073740278;
    }
    else if( (v7->Tcb._bf_0 & 0x400) != 0 || v7->PicoContext )
    {
      v5 = -1073741816;
    }
    else
    {
      v5 = PspSetContextThreadInternal(v7, ThreadContext, PreviousMode, PreviousMode, 1u);
    }
    HalPutDmaAdapter((PADAPTER_OBJECT)v7);
  }
  UserData.Reserved = 0;
  UserData.Ptr = (unsigned __int64)&v9;
  v9 = v5;
  UserData.Size = 4;
  EtwWrite(*(&ExBootDevicesRemovedEvent + 379), &KERNEL_AUDIT_API_SETCONTEXTTHREAD, 0, 1u, &UserData);
  return v5;
}

Referenced by: