KiAttachProcess

VOID __stdcall KiAttachProcess(
        _ETHREAD *Thread,
        _EPROCESS *Process,
        UINT8 OldIrql,
        UINT64 Force,
        _KAPC_STATE *SavedApcState){
  _KAPC_STATE *v5; 
  $F25F8C4BA33AF922A5F1AF68CD89DDDF *v6; 
  char v8; 
  unsigned __int64 v9; 
  _LIST_ENTRY *Flink; 
  $F25F8C4BA33AF922A5F1AF68CD89DDDF *v12; 
  _LIST_ENTRY *v13; 
  int v14; 
  struct _KPRCB *v15; 
  _EPROCESS *v16; 
  unsigned __int64 GroupIndex; 
  __int64 v18; 
  unsigned __int64 DirectoryTableBase; 
  unsigned __int64 v20; 
  struct _KPRCB *CurrentPrcb; 
  _LIST_ENTRY *v22; 
  _LIST_ENTRY *Blink; 
  _DWORD *SchedulerAssist; 
  int v25; 
  unsigned __int64 v26; 
  unsigned __int64 v27; 
  UINT64 SpinCount; 

  v5 = SavedApcState;
  v6 = &Thread->Tcb.152;
  v8 = Force;
  v9 = OldIrql;
  SavedApcState->Process = Thread->Tcb.ApcState.Process;
  *(_WORD *)&v5->InProgressFlags = *(_WORD *)&Thread->Tcb.ApcStateFill[40];
  v5->UserApcPendingAll = Thread->Tcb.ApcState.UserApcPendingAll;
  Flink = Thread->Tcb.ApcState.ApcListHead[0].Flink;
  if( Flink == (_LIST_ENTRY *)v6 )
  {
    v5->ApcListHead[0].Blink = (_LIST_ENTRY *)v5;
    v5->ApcListHead[0].Flink = (_LIST_ENTRY *)v5;
    v5->KernelApcPending = 0;
  }
  else
  {
    Blink = v6->ApcState.ApcListHead[0].Blink;
    v5->ApcListHead[0].Flink = Flink;
    v5->ApcListHead[0].Blink = Blink;
    Flink->Blink = (_LIST_ENTRY *)v5;
    Blink->Flink = (_LIST_ENTRY *)v5;
  }
  v12 = ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v6->ApcState.ApcListHead[1].Flink;
  v13 = &v5->ApcListHead[1];
  if( v12 == ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)&v6->ApcStateFill[16] )
  {
    v5->ApcListHead[1].Blink = &v5->ApcListHead[1];
    v13->Flink = v13;
    v5->UserApcPendingAll = 0;
  }
  else
  {
    v22 = v6->ApcState.ApcListHead[1].Blink;
    v13->Flink = (_LIST_ENTRY *)v12;
    v5->ApcListHead[1].Blink = v22;
    v12->ApcState.ApcListHead[0].Blink = v13;
    v22->Flink = v13;
  }
  v6->ApcState.ApcListHead[0].Blink = (_LIST_ENTRY *)v6;
  Thread->Tcb.ApcState.ApcListHead[1].Blink = &Thread->Tcb.ApcState.ApcListHead[1];
  Thread->Tcb.ApcState.ApcListHead[1].Flink = &Thread->Tcb.ApcState.ApcListHead[1];
  v6->ApcState.ApcListHead[0].Flink = (_LIST_ENTRY *)v6;
  *(_WORD *)&Thread->Tcb.ApcStateFill[40] = 0;
  Thread->Tcb.ApcState.UserApcPendingAll = 0;
  if( v5 == (_KAPC_STATE *)&Thread->Tcb.600 )
    Thread->Tcb.ApcStateIndex = 1;
  if( (Force & 1) == 0 && (_InterlockedExchangeAdd(&Process->Pcb.StackCount.Value, 8u) & 7) != 0 )
  {
    KiReleaseThreadLockSafe((INT64)Thread);
    KiInSwapSingleProcess(Thread, Process, v9);
    KeGetCurrentIrql();
    __writecr8(2ui64);
    CurrentPrcb = KeGetCurrentPrcb();
    LODWORD(SpinCount) = 0;
    while( _interlockedbittestandset64((volatile signed __int32 *)&Thread->Tcb.ThreadLock, 0i64) )
    {
      do
        KeYieldProcessorEx(&SpinCount);
      while( Thread->Tcb.ThreadLock );
      SchedulerAssist = CurrentPrcb->SchedulerAssist;
      if( SchedulerAssist && CurrentPrcb->NestingLevel <= 1u )
      {
        v25 = SchedulerAssist[6] + 1;
        SchedulerAssist[6] = v25;
      }
    }
  }
  Thread->Tcb._bf_0 |= 0x800u;
  Thread->Tcb.ApcState.Process = Process;
  v14 = v8 & 2;
  if( !v14 )
    Thread->Tcb.ThreadLock = 0i64;
  v15 = KeGetCurrentPrcb();
  v16 = v5->Process;
  GroupIndex = v15->GroupIndex;
  v18 = 8i64 * v15->Group + 376;
  _interlockedbittestandset64((volatile signed __int32 *)&Process->Pcb.gap0[v18], GroupIndex);
  DirectoryTableBase = Process->Pcb.DirectoryTableBase;
  if( KiKvaShadow )
  {
    v20 = Process->Pcb.DirectoryTableBase;
    if( (DirectoryTableBase & 2) != 0 )
      v20 = DirectoryTableBase | 0x8000000000000000ui64;
    __writegsqword(0x9000u, v20);
    KiSetAddressPolicy(Process->Pcb.AddressPolicy);
  }
  __writecr3(DirectoryTableBase);
  if( !KiFlushPcid && KiKvaShadow )
  {
    v26 = __readcr4();
    if( (v26 & 0x20080) != 0 )
    {
      __writecr4(v26 ^ 0x80);
      __writecr4(v26);
    }
    else
    {
      v27 = __readcr3();
      __writecr3(v27);
    }
  }
  _interlockedbittestandreset64((volatile signed __int32 *)&v16->Pcb.gap0[v18], GroupIndex);
  Thread->Tcb._bf_0 &= ~0x800u;
  if( !v14 )
    __writecr8(v9);
}

Referenced by: