PspThreadDelete

NTSTATUS __stdcall PspThreadDelete(PVOID P){
  INT64 v2; 
  void *v3; 
  char *v4; 
  char *v5; 
  _ETHREAD *CurrentThread; 
  _HANDLE_TABLE_ENTRY *v7; 
  void *v8; 
  UINT64 UnbiasedInterruptTime; 
  __int64 v10; 
  unsigned __int64 v11; 
  __int64 *v12; 
  __int64 v13; 
  __int64 v14; 
  int v15; 
  _QWORD *v16; 
  char *v17; 
  __int64 v18; 
  __int64 v19; 
  UINT64 v20; 
  unsigned __int64 v21; 
  volatile INT64 *v22; 
  char *v23; 
  __int64 v24; 
  char **v25; 
  ULONG_PTR BugCheckParameter4; 
  INT64 v28; 
  void *v29; 
  KeCleanupThreadState((_KTHREAD *)P);
  if( *((_DWORD *)P + 343) )
    KeBugCheckEx(0x94u, 1ui64, (ULONG_PTR)P, *((unsigned int *)P + 343), 0i64);
  if( *((_DWORD *)P + 340) )
    KeBugCheckEx(0x13Cu, (ULONG_PTR)P, *((unsigned int *)P + 340), 0i64, 0i64);
  if( *((_DWORD *)P + 341) )
    KeBugCheckEx(0x13Cu, (ULONG_PTR)P, *((unsigned int *)P + 341), 1ui64, 0i64);
  if( *((_DWORD *)P + 342) )
    KeBugCheckEx(0x13Cu, (ULONG_PTR)P, *((unsigned int *)P + 342), 2ui64, 0i64);
  v4 = (char *)*((_QWORD *)P + 197);
  if( v4 != (char *)P + 1576 )
    KeBugCheckEx(0x1C6u, 0x14ui64, (ULONG_PTR)P, (ULONG_PTR)v4, 0i64);
  v5 = (char *)*((_QWORD *)P + 200);
  if( v5 != (char *)P + 1600 )
    KeBugCheckEx(0x1C6u, 0x15ui64, (ULONG_PTR)P, (ULONG_PTR)v5, 0i64);
  if( *((_QWORD *)P + 5) )
    KeEnumerateKernelStackSegments(P, (__int64(__fastcall *)(__int64, __int128 *, __int64))PspDeleteKernelStack, 0i64);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  if( *((_QWORD *)P + 144) )
  {
    --*((_WORD *)CurrentThread + 242);
    v7 = ExMapHandleToPointer(PspCidTable, *((VOID **)P + 144), v3, (INT64)v5, BugCheckParameter4, v28, v29);
    if( !v7 )
      KeBugCheck(0x17ui64);
    ExDestroyHandle(PspCidTable, *((VOID **)P + 144), v7);
    KeLeaveCriticalRegionThread((__int64)CurrentThread);
  }
  PspDeleteThreadSecurity((INT64)P, v2, (INT64)v3);
  v8 = (void *)*((_QWORD *)P + 194);
  if( v8 )
    ExFreePoolWithTag(v8, 0x6D4E6854u);
  UnbiasedInterruptTime = KiQueryUnbiasedInterruptTime(1u);
  if( UnbiasedInterruptTime >= qword_140C4C3B0 )
  {
    v10 = qword_140C4C3A0;
    if( qword_140C4C3A0 )
    {
      if( (_DWORD)qword_140C4C3B8 )
      {
        v11 = 0i64;
        v12 = ObpObjectTypes;
        v13 = (unsigned int)qword_140C4C3B8;
        do
        {
          v14 = *v12;
          if( ((*(unsigned __int8 *)(*v12 + 66) >> 6) & 1) != _bittest64(&qword_140C4C3C0, v11) && !qword_140C4C370 )
          {
            qword_140C4C370 = (unsigned int)__ROL4__(1207959560, 133);
            xmmword_140C4C378 = 0i64;
            qword_140C4C388 = 268i64;
            qword_140C4C390 = v14;
          }
          ++v11;
          ++v12;
          --v13;
        }
        while( v13 );
        v10 = qword_140C4C3A0;
      }
      v15 = 64;
      v16 = (_QWORD *)(qword_140C4C3E0 + 112);
      v17 = (char *)(qword_140C4C3E0 + 112);
      if( qword_140C4C3E0 + 112 < (unsigned __int64)(qword_140C4C3E0 + 176) )
      {
        do
        {
          _mm_prefetchnta(v17);
          v17 += 64;
        }
        while( (unsigned __int64)v17 < qword_140C4C3E0 + 176 );
      }
      v18 = 8i64;
      do
      {
        v10 = __ROR8__(v10 - *v16++, qword_140C4C3A8);
        v15 -= 8;
        --v18;
      }
      while( v18 );
      for( ; v15; --v15 )
      {
        v19 = *(unsigned __int8 *)v16;
        v16 = (_QWORD *)((char *)v16 + 1);
        v10 = __ROR8__(v10 - v19, qword_140C4C3A8);
      }
      if( qword_140C4C3E8 != v10 )
      {
        if( qword_140C4C370 )
          goto LABEL_45;
        qword_140C4C370 = (unsigned int)__ROR4__(150994945, 152);
        xmmword_140C4C378 = 0i64;
        qword_140C4C388 = 268i64;
        qword_140C4C390 = qword_140C4C3E0;
      }
    }
    if( !qword_140C4C370 )
    {
LABEL_31:
      v20 = KiQueryUnbiasedInterruptTime(1u);
      v21 = 41929663 * (__rdtsc() >> 4) % 0x12A05F2000i64;
      LODWORD(UnbiasedInterruptTime) = v20 + v21 + 237191168;
      qword_140C4C3B0 = v20 + v21 + 288000000000i64;
      goto LABEL_32;
    }
LABEL_45:
    if( (VOID(__stdcall *)(KDPC *, PVOID, PVOID, PVOID))stru_140C4C330.DeferredRoutine != KiScanQueues )
      KeInitializeDpc(&stru_140C4C330, KiScanQueues, &stru_140C4C330);
    qword_140C4C398 = 1934400i64;
    KeInsertQueueDpc(&stru_140C4C330, 0i64, 0i64);
    goto LABEL_31;
  }
LABEL_32:
  v22 = (volatile INT64 *)*((_QWORD *)P + 68);
  if( v22 )
  {
    v23 = (char *)P + 1256;
    if( *((_QWORD *)P + 157) )
    {
      --*((_WORD *)CurrentThread + 242);
      ExAcquirePushLockExclusiveEx((UINT64)(v22 + 135), 0i64);
      ExAcquirePushLockExclusiveEx((UINT64)(v22 + 268), 0i64);
      KeFoldProcessStatisticsThread((__int64)P);
      v24 = *(_QWORD *)v23;
      if( *(char **)(*(_QWORD *)v23 + 8i64) != v23 || (v25 = (char **)*((_QWORD *)P + 158), *v25 != v23) )
        __fastfail(3u);
      *v25 = (char *)v24;
      *(_QWORD *)(v24 + 8) = v25;
      if( (_InterlockedExchangeAdd64(v22 + 268, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock(v22 + 268);
      KeAbPostRelease((PVOID)(v22 + 268));
      if( (_InterlockedExchangeAdd64(v22 + 135, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock(v22 + 135);
      KeAbPostRelease((PVOID)(v22 + 135));
      KeLeaveCriticalRegionThread((__int64)CurrentThread);
    }
    if( (*((_DWORD *)P + 324) & 0x100000) != 0 )
      ((void(__fastcall *)(PVOID))xmmword_140C1DE50)(P);
    LODWORD(UnbiasedInterruptTime) = ObfDereferenceObjectWithTag((PVOID)v22, 0x72437350ui64);
  }
  return UnbiasedInterruptTime;
}

Referenced by: