PsGetWorkOnBehalfThread

__int64 __fastcall PsGetWorkOnBehalfThread(__int64 a1, _DWORD *a2){
  __int64 v2; 
  KIRQL v6; 
  unsigned __int64 v7; 
  v2 = *(_QWORD *)(a1 + 1472);
  *a2 = 0;
  if( v2 && (struct _KTHREAD *)a1 != KeGetCurrentThread() )
  {
    v6 = ExAcquireSpinLockShared((PEX_SPIN_LOCK)PspThreadWorkOnBehalfLock);
    v2 = *(_QWORD *)(a1 + 1472);
    v7 = v6;
    if( v2 )
    {
      ObfReferenceObjectWithTag(*(PVOID *)(a1 + 1472), 0x746C6644u);
      *a2 = 1;
    }
    ExReleaseSpinLockSharedFromDpcLevel((PEX_SPIN_LOCK)PspThreadWorkOnBehalfLock);
    __writecr8(v7);
  }
  return v2;
}

Referenced by: