PsCreateSystemThreadEx

NTSTATUS __stdcall PsCreateSystemThreadEx(
        PVOID *ThreadHandle,
        UINT64 DesiredAccess,
        OBJECT_ATTRIBUTES *ObjectAttributes,
        PVOID ProcessHandle,
        CLIENT_ID *ClientId,
        PKSTART_ROUTINE StartRoutine,
        PVOID StartContext,
        GROUP_AFFINITY *GroupAffinity,
        UINT64 *IdealProcessor){
  __int128 *v10; 
  char v13; 
  __int64 v14; 
  _DWORD *v15; 
  NTSTATUS Thread; 
  __int128 v18; 
  __int128 v19; 
  unsigned int v20; 
  __int128 v21; 
  int v22; 
  __int64 a6; 
  INT64 a2; 
  INT64 a3[2]; 
  __m128i v26; 
  __int128 v27; 
  INT64 a12; 
  INT64 a11; 
  INT64 a7; 
  __int128 v31; 
  _DWORD result[63]; 
  int v33; 
  __int128 v34; 
  v10 = (__int128 *)GroupAffinity;
  a7 = (INT64)ClientId;
  a11 = (INT64)StartRoutine;
  LODWORD(a2) = DesiredAccess;
  a12 = (INT64)StartContext;
  memset((INT64)result, 0i64);
  *(_OWORD *)a3 = 0i64;
  a6 = 0i64;
  v26 = 0i64;
  v27 = 0i64;
  v31 = 0i64;
  if( KeGetCurrentIrql() > 1u )
    KeBugCheckEx(0xC8u, ((unsigned __int64)KeGetCurrentIrql() << 16) | 4, 0i64, 0i64, 0i64);
  v13 = 0;
  if( ProcessHandle )
  {
    Thread = ObpReferenceObjectByHandleWithTag(
               (ULONG_PTR)ProcessHandle,
               2,
               (__int64)PsProcessType,
               0,
               0x72437350u,
               (__int64)&a6,
               0i64,
               0i64);
    if( Thread < 0 )
      return Thread;
    v14 = a6;
    v13 = 1;
  }
  else
  {
    v14 = *((_QWORD *)PspSystemPartition + 13);
    a6 = v14;
  }
  v15 = (_DWORD *)(v14 + 2172);
  if( (*(_DWORD *)(v14 + 2172) & 0x1000) != 0 )
  {
    if( GroupAffinity )
      goto LABEL_17;
    if( !IdealProcessor )
    {
      v20 = (unsigned __int16)(_InterlockedExchangeAdd(&PspSystemThreadAssignment, 1u) + 1);
      v10 = &v31;
      WORD4(v31) = v20 % KeQueryActiveGroupCount();
      v14 = a6;
      *(_QWORD *)&v31 = KeActiveProcessors.Bitmap[WORD4(v31)];
    }
    if( v10 )
    {
LABEL_17:
      v21 = *v10;
      v22 = 4096;
      result[1] = 4096;
      v34 = v21;
    }
    else
    {
      v22 = result[1];
    }
    if( IdealProcessor )
    {
      result[1] = v22 | 0x4000;
      v33 = *(_DWORD *)IdealProcessor;
    }
  }
  if( ObjectAttributes )
  {
    v18 = *(_OWORD *)&ObjectAttributes->Length;
    v26 = *(__m128i *)&ObjectAttributes->ObjectName;
    *(_OWORD *)a3 = v18;
    v19 = *(_OWORD *)&ObjectAttributes->SecurityDescriptor;
    v26.m128i_i32[2] = _mm_cvtsi128_si32(_mm_srli_si128(v26, 8)) | 0x200;
    v27 = v19;
  }
  else
  {
    LODWORD(a3[0]) = 48;
    v27 = 0i64;
    a3[1] = 0i64;
    v26.m128i_i32[2] = 512;
    v26.m128i_i64[0] = 0i64;
  }
  Thread = PspCreateThread(
             (INT64)ThreadHandle,
             (unsigned int)a2,
             (INT64)a3,
             0i64,
             (_EPROCESS *)v14,
             (unsigned __int64)result & -(__int64)((*v15 & 0x1000) != 0),
             a7,
             0i64,
             0i64,
             0,
             a11,
             a12,
             0i64);
  if( v13 )
    ObfDereferenceObjectWithTag((PVOID)v14, 0x72437350ui64);
  return Thread;
}

Referenced by: