NtCreateThreadEx

NTSTATUS __stdcall NtCreateThreadEx(
        VOID **ThreadHandle,
        UINT64 DesiredAccess,
        _OBJECT_ATTRIBUTES *ObjectAttributes,
        VOID *ProcessHandle,
        VOID *StartRoutine,
        VOID *Argument,
        UINT64 CreateFlags,
        UINT64 ZeroBits,
        UINT64 StackSize,
        UINT64 MaximumStackSize,
        PS_ATTRIBUTE_LIST *AttributeList){
  NTSTATUS result; 
  unsigned __int64 v14; 
  unsigned int v15; 
  unsigned __int64 v16; 
  void *v17; 
  INT64 v18; 
  NTSTATUS Thread; 
  __int64 v20; 
  UINT64 Tag; 
  size_t v22; 
  int v23; 
  PVOID Object; 
  __int64 v25; 
  INT64 v26; 
  _OBJECT_ATTRIBUTES *v27; 
  _PSP_STACK_ALLOCATION_STATE v28[5]; 
  _PSP_CREATE_PROCESS_CONTEXT CreateContext[132]; 
  _ETHREAD *v30[4]; 

  v27 = ObjectAttributes;
  v23 = DesiredAccess;
  v26 = (INT64)Argument;
  memset(v28, 0i64, 0x48u);
  Object = 0i64;
  *(_DWORD *)((char *)v30 + 1) = 0;
  *(_WORD *)((char *)v30 + 5) = 0;
  HIBYTE(v30[0]) = 0;
  v25 = 0i64;
  v22 = 0;
  if( (CreateFlags & 0xFFFFFF80) != 0 )
    return -1073741579;
  if( KeGetCurrentThread()->PreviousMode )
  {
    v20 = (__int64)ThreadHandle;
    if( (unsigned __int64)ThreadHandle >= 0x7FFFFFFF0000i64 )
      v20 = 0x7FFFFFFF0000i64;
    *(_QWORD *)v20 = *(_QWORD *)v20;
  }
  LOBYTE(v30[0]) = 0;
  v30[2] = (_ETHREAD *)StackSize;
  v30[3] = (_ETHREAD *)MaximumStackSize;
  v30[1] = (_ETHREAD *)ZeroBits;
  memset(CreateContext, 0i64, 0x208u);
  if( !AttributeList
    || (result = PspBuildCreateProcessContext(AttributeList, KeGetCurrentThread()->PreviousMode, 1ui64, CreateContext),
        result >= 0) )
  {
    LODWORD(Tag) = 1917023056;
    result = ObpReferenceObjectByHandleWithTag(
               ProcessHandle,
               2ui64,
               (_OBJECT_TYPE *)PsProcessType,
               KeGetCurrentThread()->PreviousMode,
               Tag,
               &Object,
               0i64,
               0i64);
    if( result >= 0 )
    {
      v14 = (*((_DWORD *)Object + 629) & 0x4000) != 0 ? 0x800 : 0;
      v15 = (*((_DWORD *)Object + 629) & 0x4000) != 0 ? 1048651 : 1048587;
      ObfDereferenceObjectWithTag(Object, 0x72437350ui64);
      RtlGetExtendedContextLength2(v15, &v22, (unsigned int)v14);
      v16 = v22 + 15i64;
      if( v16 <= v22 )
        v16 = 0xFFFFFFFFFFFFFF0i64;
      v17 = alloca(v16 & 0xFFFFFFFFFFFFFFF0ui64);
      memset(&v22, 0i64, v22);
      RtlInitializeExtendedContext2((__int64)&v22, v15, &v25, v14);
      PspCreateUserContext((INT64)&v22, 1, PspUserThreadStart, (INT64)StartRoutine, v26);
      Thread = PspCreateThread(
                 (__int64)ThreadHandle,
                 v23,
                 v27,
                 ProcessHandle,
                 0i64,
                 CreateContext,
                 *(__int64 *)&CreateContext[4],
                 (_CONTEXT *)&v22,
                 v28,
                 CreateFlags,
                 StartRoutine,
                 v18,
                 v30);
      PspDeleteCreateProcessContext(CreateContext);
      return Thread;
    }
  }
  return result;
}

Referenced by: