PsOpenThread

INT64 __fastcall PsOpenThread(
        VOID **ThreadHandle,
        INT64 DesiredAccess,
        OBJECT_ATTRIBUTES *ObjectAttributes,
        CLIENT_ID *ClientId,
        INT64 ProbeMode,
        INT64 AccessMode,
        INT64 a7,
        INT64 a8){
  unsigned int v10; 
  int v12; 
  __int64 v13; 
  bool v14; 
  unsigned int v15; 
  char v16; 
  KPROCESSOR_MODE v17; 
  int AccessState; 
  INT8 v19; 
  char v21; 
  KPROCESSOR_MODE v22; 
  HANDLE *Thread; 
  HANDLE ThreadId[2]; 
  ULONG HandleAttributes; 
  unsigned int v26; 
  int v27; 
  unsigned int v28; 
  unsigned int v29; 
  int v30; 
  int v31; 
  unsigned int v32; 
  int v33; 
  void *Handle; 
  VOID **v35; 
  __int64 v36; 
  INT64 result[2]; 
  int v38; 
  int v39; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  __int64 v41[28]; 
  struct _EVENT_DATA_DESCRIPTOR UserData; 
  int *v43; 
  __int64 v44; 
  int *v45; 
  __int64 v46; 
  int *v47; 
  __int64 v48; 
  struct _EVENT_DATA_DESCRIPTOR v49; 
  unsigned int *v50; 
  __int64 v51; 
  int *v52; 
  __int64 v53; 
  int *v54; 
  __int64 v55; 
  int *v56; 
  __int64 v57; 
  char *v58; 
  __int64 v59; 
  char *v60; 
  __int64 v61; 
  __int64 *v62; 
  __int64 v63; 
  v10 = DesiredAccess;
  v35 = ThreadHandle;
  Handle = 0i64;
  Thread = 0i64;
  *(_OWORD *)ThreadId = 0i64;
  memset((INT64)result, 0i64);
  memset((INT64)v41, 0i64);
  v12 = 0;
  if( (_BYTE)ProbeMode )
  {
    v13 = (__int64)ThreadHandle;
    if( (unsigned __int64)ThreadHandle >= 0x7FFFFFFF0000i64 )
      v13 = 0x7FFFFFFF0000i64;
    *(_QWORD *)v13 = *(_QWORD *)v13;
    if( ((unsigned __int8)ObjectAttributes & 3) == 0 )
    {
      v14 = ObjectAttributes->ObjectName != 0i64;
      v15 = ObjectAttributes->Attributes & 0x1DF2;
      HandleAttributes = v15;
      if( !ClientId )
      {
        v16 = 0;
        goto LABEL_8;
      }
      if( ((unsigned __int8)ClientId & 3) == 0 )
      {
        *(CLIENT_ID *)ThreadId = *ClientId;
        v16 = 1;
        v15 = HandleAttributes;
LABEL_8:
        v17 = AccessMode;
        goto LABEL_11;
      }
    }
    ExRaiseDatatypeMisalignment();
  }
  v14 = ObjectAttributes->ObjectName != 0i64;
  v17 = AccessMode;
  v15 = ObjectAttributes->Attributes & ((_BYTE)AccessMode != 0 ? 7666 : 73714);
  if( ClientId )
  {
    *(CLIENT_ID *)ThreadId = *ClientId;
    v16 = 1;
  }
  else
  {
    v16 = 0;
  }
LABEL_11:
  if( v14 || !v16 )
  {
    AccessState = -1073741776;
  }
  else
  {
    while( 1 )
    {
      AccessState = SeCreateAccessState(
                      (_ACCESS_STATE *)result,
                      (_AUX_ACCESS_DATA *)v41,
                      v10,
                      (_GENERIC_MAPPING *)((char *)PsThreadType + 76));
      if( AccessState < 0 )
        break;
      if( (v15 & 0x400) == 0 || (v19 = 1, v12) )
        v19 = v17;
      if( SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, v19) )
      {
        if( (v38 & 0x2000000) != 0 )
          v39 |= 0x1FFFFFu;
        else
          v39 |= v38;
        v38 = 0;
      }
      if( ThreadId[0] )
      {
        AccessState = PsLookupProcessThreadByCid((__int64)ThreadId, 0i64, (PADAPTER_OBJECT *)&Thread);
        if( AccessState < 0 )
        {
LABEL_27:
          SepDeleteAccessState((ACCESS_STATE *)result);
          SeReleaseSubjectContext(&SubjectContext);
          break;
        }
      }
      else
      {
        AccessState = PsLookupThreadByThreadId(ThreadId[1], (PETHREAD *)&Thread);
        if( AccessState < 0 )
          goto LABEL_27;
        ThreadId[0] = Thread[143];
      }
      AccessState = ObOpenObjectByPointer(
                      Thread,
                      v15,
                      (PACCESS_STATE)result,
                      0,
                      (POBJECT_TYPE)PsThreadType,
                      v17,
                      &Handle);
      SepDeleteAccessState((ACCESS_STATE *)result);
      SeReleaseSubjectContext(&SubjectContext);
      HalPutDmaAdapter((PADAPTER_OBJECT)Thread);
      if( AccessState >= 0 )
      {
        *v35 = Handle;
        if( v12 && (unsigned int)dword_140C01AB0 > 5 && tlgKeywordOn((__int64)&dword_140C01AB0, 0x400000000000i64) )
        {
          v26 = (unsigned int)PsGetThreadId((PETHREAD)Thread);
          v50 = &v26;
          v51 = 4i64;
          v27 = (int)ThreadId[0];
          v52 = &v27;
          v53 = 4i64;
          v28 = v10;
          v54 = (int *)&v28;
          v55 = 4i64;
          v29 = v15;
          v56 = (int *)&v29;
          v57 = 4i64;
          v21 = ProbeMode;
          v58 = &v21;
          v59 = 1i64;
          v22 = v17;
          v60 = &v22;
          v61 = 1i64;
          v36 = 0x1000000i64;
          v62 = &v36;
          v63 = 8i64;
          tlgWriteTransfer_EtwWriteTransfer(
            (__int64)&dword_140C01AB0,
            (unsigned __int8 *)byte_14002B200,
            0i64,
            0i64,
            9u,
            &v49);
        }
        break;
      }
      if( (v15 & 0x400) == 0 || AccessState != -1073741790 || v12 )
        break;
      v12 = 1;
    }
  }
  v33 = AccessState;
  v32 = v10;
  v31 = (int)ThreadId[1];
  v30 = (int)ThreadId[0];
  UserData.Ptr = (unsigned __int64)&v30;
  *(_QWORD *)&UserData.Size = 4i64;
  v43 = &v31;
  v44 = 4i64;
  v45 = (int *)&v32;
  v46 = 4i64;
  v47 = &v33;
  v48 = 4i64;
  EtwWrite(EtwApiCallsProvRegHandle, (EVENT_DESCRIPTOR *)&KERNEL_AUDIT_API_OPENTHREAD, 0i64, 4ui64, &UserData);
  return(unsigned int)AccessState;
}

Referenced by: