PsConvertToGuiThread

NTSTATUS __stdcall PsConvertToGuiThread(){
  _ETHREAD *CurrentThread; 
  _EPROCESS *Process; 
  unsigned int MitigationFlags; 
  int v3; 
  __int64 v4; 
  __int64 v5; 
  char v6; 
  NTSTATUS result; 
  int v8; 
  int v9; 
  _EPROCESS *Parameters; 
  int v11; 
  int v12; 
  _ETHREAD *v13; 
  int v14; 
  int v15; 
  UINT8 SignatureLevel; 

  v12 = 0;
  v15 = 0;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  SignatureLevel = 0;
  if( !CurrentThread->Tcb.PreviousMode )
    return -1073741811;
  if( (*(&CurrentThread->Tcb.MiscFlags + 1) & 0x80u) != 0 )
    return 1073741851;
  Process = CurrentThread->Tcb.ApcState.Process;
  MitigationFlags = Process->MitigationFlags;
  if( (MitigationFlags & 0x1000) != 0 || (Process->MitigationFlags & 0x2000) != 0 )
  {
    EtwTimLogProhibitWin32kSystemCalls(
      (unsigned int)((MitigationFlags & 0x1000) != 0) + 1,
      (INT64)CurrentThread->Tcb.ApcState.Process);
    if( (MitigationFlags & 0x1000) != 0 )
      return -1073741790;
  }
  v3 = 1;
  Parameters = Process;
  v11 = 1;
  if( PsQuerySectionSignatureInformation(Process, &SignatureLevel) >= 0 )
  {
    v6 = (char)qword_140C1D900;
    if( qword_140C1D900 )
    {
      LOBYTE(v5) = SignatureLevel;
      LOBYTE(v4) = 12;
      v6 = qword_140C1D900(v5, v4);
      v3 = v11;
    }
    v11 = ((unsigned __int8)v3 ^ (unsigned __int8)(2 * v6)) & 2 ^ v3;
  }
  result = PsInvokeWin32Callout(Win32ProcessCallout, &Parameters, PsWin32SessionAttachNone, 0i64);
  if( result >= 0 )
  {
    _interlockedbittestandset((volatile signed __int32 *)&CurrentThread->Tcb.116 + 1, 7u);
    v8 = MitigationFlags & 0xC000;
    if( v8 )
      _interlockedbittestandset((volatile signed __int32 *)&CurrentThread->Tcb.116 + 1, 0x15u);
    v14 = 0;
    v13 = CurrentThread;
    v9 = PsInvokeWin32Callout(Win32ThreadCallout, &v13, PsWin32SessionAttachNone, 0i64);
    if( v9 < 0 )
    {
      _interlockedbittestandreset((volatile signed __int32 *)&CurrentThread->Tcb.116 + 1, 7u);
      if( v8 )
        _interlockedbittestandreset((volatile signed __int32 *)&CurrentThread->Tcb.116 + 1, 0x15u);
    }
    SeCaptureAtomTableCallout();
    return v9;
  }
  return result;
}

Referenced by: