KeStartThread

VOID __stdcall KeStartThread(_ETHREAD *Thread, _GROUP_AFFINITY *GroupAffinity, UINT64 *IdealProcessor){
  _GROUP_AFFINITY *p_Affinity; 
  _KNODE *v6; 
  unsigned __int16 ThreadSeed; 
  _ETHREAD *CurrentThread; 
  __int64 v9; 
  UINT16 v10; 
  UINT64 *v11; 
  char v12; 
  WORK_QUEUE_TYPE v13; 
  void *v14; 
  __int64 v15; 
  unsigned int v16; 
  _QWORD *v17; 
  _KPRCB *v18; 
  int v19; 
  int v20; 
  __int64 v21; 
  _QWORD *v22; 
  _QWORD *v23; 
  char v24; 
  char v25; 
  _QWORD *v26; 
  _QWORD *v27; 
  __int64 Group; 
  __int64 v29; 
  char v30; 
  char v31; 
  UINT64 AltSeed; 
  __int64 CurrentIrql; 
  __int64 v34; 
  struct _KLOCK_QUEUE_HANDLE LockHandle; 
  _GROUP_AFFINITY Affinity; 
  HIDWORD(AltSeed) = 0;
  v34 = 0i64;
  p_Affinity = GroupAffinity;
  Affinity = 0i64;
  memset(&LockHandle, 0, sizeof(LockHandle));
  if( !IdealProcessor && GroupAffinity && GroupAffinity->Mask )
  {
    v6 = KeSelectNodeForAffinity(GroupAffinity);
    v31 = v30;
    ThreadSeed = v6->ThreadSeed;
  }
  else
  {
    v6 = 0i64;
    v31 = 1;
    ThreadSeed = 0;
  }
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v9 = *((_QWORD *)Thread + 23);
  *((_DWORD *)Thread + 30) ^= (*((_DWORD *)Thread + 30) ^ (4 * *(_DWORD *)(v9 + 632))) & 8;
  CurrentIrql = KeGetCurrentIrql();
  __writecr8(2ui64);
  ExAcquireSpinLockExclusiveAtDpcLevel((INT64 *)(v9 + 64));
  v12 = *(_BYTE *)(v9 + 640);
  *((_BYTE *)Thread + 563) = v12;
  *((_BYTE *)Thread + 195) = v12;
  if( p_Affinity )
  {
    Group = p_Affinity->Group;
    v29 = *(_QWORD *)(v9 + 8 * Group + 88);
    if( !v29 || (v29 & p_Affinity->Mask) != p_Affinity->Mask )
      KiExtendProcessAffinity(v9, Group);
    if( !p_Affinity->Mask )
      p_Affinity->Mask = *(_QWORD *)(v9 + 8i64 * p_Affinity->Group + 88);
  }
  else
  {
    if( v9 == *((_QWORD *)CurrentThread + 68) )
    {
      Affinity.Group = *((_WORD *)CurrentThread + 280);
      Affinity.Mask = *(_QWORD *)(v9 + 8i64 * Affinity.Group + 88);
    }
    else
    {
      KeFirstGroupAffinityEx(&Affinity, v9 + 80, v10, v11);
    }
    p_Affinity = &Affinity;
  }
  *((_WORD *)Thread + 292) = p_Affinity->Group;
  *((_QWORD *)Thread + 72) = p_Affinity->Mask;
  *((_WORD *)Thread + 280) = p_Affinity->Group;
  *((_QWORD *)Thread + 69) = p_Affinity->Mask;
  KiUpdateNodeAffinitizedFlag((_KTHREAD *)Thread);
  if( IdealProcessor )
  {
    v16 = *(_DWORD *)IdealProcessor;
  }
  else
  {
    if( !v6 )
    {
      v15 = p_Affinity->Group;
      ThreadSeed = *(_WORD *)(v9 + 2 * v15 + 644);
      v6 = (_KNODE *)*((_QWORD *)&KeNodeBlock + *(unsigned __int16 *)(v9 + 2 * v15 + 772));
      HIDWORD(AltSeed) = *(unsigned __int16 *)(v9 + 2 * v15 + 708);
      v34 = (__int64)&AltSeed + 4;
    }
    p_Affinity->Mask &= v6->Affinity.Mask;
    LOWORD(AltSeed) = ThreadSeed;
    v16 = (unsigned __int16)KeSelectIdealProcessor(v6, p_Affinity, &AltSeed);
    if( v31 )
      *(_WORD *)(v9 + 2i64 * p_Affinity->Group + 644) = AltSeed;
  }
  *((_DWORD *)Thread + 49) = v16;
  v17 = (_QWORD *)(v9 + 48);
  *((_DWORD *)Thread + 147) = v16;
  v18 = *(&KiProcessorBlock + v16);
  if( (_QWORD *)*v17 == v17 && (__int64 *)v9 != KiInitialProcess )
  {
    LockHandle.LockQueue.Next = 0i64;
    LockHandle.LockQueue.Lock = (unsigned __int64 *volatile)KiProcessListLock;
    KxAcquireQueuedSpinLock((PIO_WORKITEM)&LockHandle, KiProcessListLock, v13, v14);
    v26 = (_QWORD *)qword_140C319F8;
    v27 = (_QWORD *)(v9 + 848);
    if( *(__int64 **)qword_140C319F8 != &KiProcessListHead )
      goto LABEL_45;
    *(_QWORD *)(v9 + 856) = qword_140C319F8;
    *v27 = &KiProcessListHead;
    *v26 = v27;
    qword_140C319F8 = v9 + 848;
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
  }
  *((_DWORD *)Thread + 30) ^= (*((_DWORD *)Thread + 30) ^ (*(_DWORD *)(v9 + 632) << 6)) & 0x100;
  v19 = *(unsigned __int8 *)(v9 + 641);
  v20 = *((_DWORD *)Thread + 30);
  *((_BYTE *)Thread + 651) = v19;
  v21 = (unsigned int)(KiCyclesPerClockQuantum * v19);
  if( (v20 & 0x20) != 0 )
    _interlockedbittestandreset((volatile signed __int32 *)Thread + 30, 5u);
  *((_QWORD *)Thread + 4) = v21;
  KiAcquireKobjectLockSafe((PVOID)v9);
  v22 = *(_QWORD **)(v9 + 56);
  v23 = (_QWORD *)((char *)Thread + 760);
  if( (_QWORD *)*v22 != v17 )
LABEL_45:
    __fastfail(3u);
  *v23 = v17;
  *((_QWORD *)Thread + 96) = v22;
  *v22 = v23;
  *(_QWORD *)(v9 + 56) = v23;
  _InterlockedAnd((volatile signed __int32 *)v9, 0xFFFFFF7F);
  if( (*(_DWORD *)(v9 + 632) & 8) != 0 )
    KiFreezeSingleThread(KeGetCurrentPrcb(), (_KTHREAD *)Thread);
  *((_QWORD *)Thread + 13) = *(_QWORD *)(v9 + 880);
  if( *(_QWORD *)(v9 + 880) )
    _interlockedbittestandset((volatile signed __int32 *)Thread, 0x12u);
  KiUpdateSharedReadyQueueAffinityThread(v18, (_KTHREAD *)Thread);
  if( *(_BYTE *)(*((_QWORD *)Thread + 68) + 1850i64) == 2
    && !*((_BYTE *)Thread + 564)
    && (*((_DWORD *)Thread + 30) & 8) == 0 )
  {
    v24 = *((_BYTE *)Thread + 195);
    if( v24 > 0 )
    {
      v25 = PsPrioritySeparation + *((_BYTE *)Thread + 563);
      if( v25 >= 16 )
        v25 = 15;
      if( v25 > v24 )
      {
        *((_BYTE *)Thread + 564) = (v25 - v24) & 0xF;
        KiUpdateThreadPriority(0i64, (_KTHREAD *)Thread, (unsigned int)v25, 0);
        KiUpdateSharedReadyQueueAffinityThread(0i64, (_KTHREAD *)Thread);
      }
    }
  }
  if( (*((_DWORD *)Thread + 29) & 0x400) == 0 )
    *((_DWORD *)Thread + 238) = *(_DWORD *)(v9 + 68);
  ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(v9 + 64));
  __writecr8((unsigned __int8)CurrentIrql);
  if( (xmmword_140CFB490 & 0x8000000) != 0 )
  {
    EtwTraceIdealProcessor((INT64)Thread, 0x546u, 0xFFFFFFFFi64, v16);
    if( (xmmword_140CFB490 & 0x8000000) != 0 )
      EtwTraceIdealProcessor((INT64)Thread, 0x547u, 0xFFFFFFFFi64, v16);
  }
  _InterlockedExchangeAdd((volatile signed __int32 *)(v9 + 840), 8u);
}

Referenced by: