KeAttachProcess

VOID __stdcall KeAttachProcess(_EPROCESS *Process){
  _ETHREAD *CurrentThread; 
  _EPROCESS *v3; 
  unsigned __int8 CurrentIrql; 
  UINT64 SpinCount; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v3 = (_EPROCESS *)*((_QWORD *)CurrentThread + 23);
  if( v3 != Process )
  {
    if( *((_BYTE *)CurrentThread + 586)
      || (*((_DWORD *)KeGetPcr() + 3243) & 0x10001) != 0
      || (*((_DWORD *)Process + 158) & 0x400) != 0 )
    {
      KeBugCheckEx(
        5u,
        (ULONG_PTR)Process,
        (ULONG_PTR)v3,
        *((unsigned __int8 *)CurrentThread + 586),
        *((_DWORD *)KeGetPcr() + 3243) & 0x10001);
    }
    CurrentIrql = KeGetCurrentIrql();
    __writecr8(2ui64);
    LODWORD(SpinCount) = 0;
    while( _interlockedbittestandset64((volatile signed __int32 *)CurrentThread + 16, 0i64) )
    {
      do
        KeYieldProcessorEx(&SpinCount);
      while( *((_QWORD *)CurrentThread + 8) );
    }
    KiAttachProcess((__int64)CurrentThread, (__int64)Process, CurrentIrql, 0, (__int64)CurrentThread + 600);
  }
}

Referenced by: