PspTerminateAllThreads

__int64 __fastcall PspTerminateAllThreads(ULONG_PTR BugCheckParameter1, ULONG_PTR a2, int a3, unsigned int a4){
  __int64 v8; 
  __int64 PreviousProcessThread; 
  unsigned int v10; 
  unsigned int v11; 
  int v12; 
  struct _EX_RUNDOWN_REF *i; 
  struct _EX_RUNDOWN_REF *v14; 
  void *v15; 
  UINT64 v16; 
  _EJOB *ProcessServerSilo; 
  INT64 ExitStatus; 
  struct _EX_RUNDOWN_REF *Object; 
  if( (*(_DWORD *)(BugCheckParameter1 + 1124) & 0x2000) != 0 )
  {
    ProcessServerSilo = (_EJOB *)PsGetProcessServerSilo(BugCheckParameter1);
    LODWORD(ExitStatus) = a3;
    PspCatchCriticalBreak(
      (INT8 *)"Terminating critical process 0x%p(%s)\n",
      (PVOID)BugCheckParameter1,
      (UINT8 *)(BugCheckParameter1 + 1448),
      ProcessServerSilo,
      ExitStatus);
  }
  v8 = *(_QWORD *)(a2 + 184);
  PreviousProcessThread = PspGetPreviousProcessThread(BugCheckParameter1, 0i64);
  v10 = a4 & 4 | (2 * (a4 & 1)) | (a4 >> 1) & 1;
  v11 = 290;
  if( PreviousProcessThread )
  {
    if( (v10 & 1) != 0 )
    {
      v11 = -1073741558;
      v16 = 1850045264i64;
      v15 = (void *)PreviousProcessThread;
    }
    else
    {
      Object = (struct _EX_RUNDOWN_REF *)PreviousProcessThread;
      v11 = 0;
      ObfReferenceObjectWithTag((PVOID)PreviousProcessThread, 0x65547350u);
      v12 = 0;
      do
      {
        if( PreviousProcessThread != a2 )
        {
          if( (v10 & 4) != 0 )
          {
            v10 ^= ((unsigned __int8)v10 ^ (unsigned __int8)(*(_DWORD *)(PreviousProcessThread + 1300) >> 3)) & 8;
          }
          else if( ExAcquireRundownProtection((PEX_RUNDOWN_REF)(PreviousProcessThread + 1272)) )
          {
            v10 |= 8u;
          }
          else
          {
            v10 = (((unsigned __int8)v10 ^ (unsigned __int8)(16
                                                           * _interlockedbittestandset(
                                                               (volatile signed __int32 *)(PreviousProcessThread + 1296),
                                                               0xFu))) & 0x10 ^ v10) & 0xFFFFFFF7;
          }
          if( (v10 & 8) != 0 )
          {
            ++v12;
            PspTerminateThreadByPointer(PreviousProcessThread, a3, 0);
          }
        }
        PreviousProcessThread = PspGetPreviousProcessThread(BugCheckParameter1, (_QWORD *)PreviousProcessThread);
      }
      while( PreviousProcessThread );
      if( v12 && BugCheckParameter1 == v8 )
        KeFlushProcessWriteBuffers(0);
      for( i = (struct _EX_RUNDOWN_REF *)PsGetNextProcessThread(BugCheckParameter1, 0i64);
            ;
            i = (struct _EX_RUNDOWN_REF *)PsGetNextProcessThread(BugCheckParameter1, v14) )
      {
        v14 = i;
        if( i != (struct _EX_RUNDOWN_REF *)a2 && (v10 & 4) == 0 && (i[162].Count & 0x8000) == 0 )
          ExReleaseRundownProtection(i + 159);
        if( v14 == Object )
          break;
      }
      ObfDereferenceObjectWithTag(v14, 0x6E457350ui64);
      v15 = Object;
      v16 = 1700033360i64;
    }
    ObfDereferenceObjectWithTag(v15, v16);
    if( (v10 & 2) != 0 && *(_QWORD *)(a2 + 544) == BugCheckParameter1 )
      PspTerminateThreadByPointer(a2, a3, 0);
  }
  if( BugCheckParameter1 != v8 && a3 == 1073807364 )
    DbgkClearProcessDebugObject(BugCheckParameter1, 0i64);
  if( (v11 == 290 || *(_QWORD *)(BugCheckParameter1 + 1400) && BugCheckParameter1 != v8)
    && !PspRundownSingleProcess(BugCheckParameter1, 0)
    && v11 == 290 )
  {
    return(unsigned int)-1073741558;
  }
  return v11;
}

Referenced by: