KeAbCrossThreadDelete

char __fastcall KeAbCrossThreadDelete(unsigned __int64 a1, ULONG_PTR a2){
  __int64 v4; 
  int v5; 
  unsigned __int64 v6; 
  int SessionId; 
  unsigned int v8; 
  __m128i *v9; 
  int v10; 
  __int128 v11; 
  unsigned __int8 v12; 
  __int64 v13; 
  __int128 v14; 
  unsigned __int8 v15; 
  __int64 v17; 
  unsigned __int8 CurrentIrql; 
  __int64 v19; 
  char v20; 
  int v21; 
  int v23[8]; 
  _KPRCB *ControlPrcb; 
  __int128 v25; 
  __int128 Object; 
  __int128 v27; 
  __int128 v28; 
  _KDPC BugCheckParameter2; 
  UINT64 SpinCount; 
  _KSHARED_READY_QUEUE *ControlReadyQueue; 
  Object = 0i64;
  v27 = 0i64;
  v28 = 0i64;
  memset((INT64)&BugCheckParameter2, 0i64);
  LODWORD(v4) = *(char *)(a2 + 792);
  v5 = v4 | *(char *)(a2 + 870);
  ControlPrcb = 0i64;
  ControlReadyQueue = 0i64;
  if( v5 != 63 )
  {
    v6 = a1 & 0x7FFFFFFFFFFFFFFCi64;
    if( (unsigned int)MmIsSessionAddress((PVOID)a1) )
      SessionId = MmGetSessionIdEx(*((_QWORD *)KeGetCurrentThread() + 23));
    else
      SessionId = -1;
    LODWORD(v4) = *(char *)(a2 + 792);
    v8 = (v4 | *(char *)(a2 + 870)) ^ 0x3F;
    while( 1 )
    {
      if( !_BitScanReverse((unsigned int *)&v17, v8) )
        return v4;
      v9 = (__m128i *)(*(_QWORD *)(a2 + 800) + 96 * v17);
      v8 &= ~(1 << v17);
      v4 = v9[2].m128i_i64[0] & 0x7FFFFFFFFFFFFFFCi64;
      if( v4 == v6 )
      {
        *(_QWORD *)&v11 = v9[2].m128i_i64[0];
        *((_QWORD *)&v11 + 1) = _mm_srli_si128(v9[2], 8).m128i_u64[0];
        v12 = _InterlockedCompareExchange128(
                v9[2].m128i_i64,
                *((signed __int64 *)&v11 + 1),
                v11,
                (signed __int64 *)&v11);
        LOBYTE(v4) = v11;
        v10 = DWORD2(v11);
        v13 = v11;
        v25 = v11;
        if( v12
          || (*(_QWORD *)&v14 = v9[2].m128i_i64[0],
              *((_QWORD *)&v14 + 1) = _mm_srli_si128(v9[2], 8).m128i_u64[0],
              v15 = _InterlockedCompareExchange128(
                      v9[2].m128i_i64,
                      *((signed __int64 *)&v14 + 1),
                      v14,
                      (signed __int64 *)&v14),
              LOBYTE(v4) = v14,
              v10 = DWORD2(v14),
              v13 = v14,
              v25 = v14,
              v15) )
        {
          if( (v9[1].m128i_i8[10] & 1) != 0 )
          {
            LOBYTE(v4) = v13 & 0xFC;
            if( (v13 & 0x7FFFFFFFFFFFFFFCi64) == v6 && v10 == SessionId )
              break;
          }
        }
      }
    }
    if( v13 >= 0 )
    {
      CurrentIrql = KeGetCurrentIrql();
      __writecr8(2ui64);
      LODWORD(SpinCount) = 0;
      while( _interlockedbittestandset64((volatile signed __int32 *)(a2 + 64), 0i64) )
      {
        do
          KeYieldProcessorEx(&SpinCount);
        while( *(_QWORD *)(a2 + 64) );
      }
      KiAcquireThreadStateLock((_ETHREAD *)a2, &ControlPrcb, &ControlReadyQueue);
      if( v20 == 2 )
      {
        v21 = *(_DWORD *)(a2 + 536);
        KiReleaseThreadStateLock(v19, (__int64)ControlPrcb, (volatile signed __int64 *)ControlReadyQueue);
        KiReleaseThreadLockSafe(a2);
        __writecr8(CurrentIrql);
        BugCheckParameter2.DpcData = 0i64;
        *(_QWORD *)&v27 = (char *)&Object + 8;
        *((_QWORD *)&Object + 1) = (char *)&Object + 8;
        BugCheckParameter2.DeferredRoutine = (void(__fastcall *)(_KDPC *, void *, void *, void *))KeAbCrossThreadDeleteDpcRoutine;
        BugCheckParameter2.DeferredContext = &Object;
        *((_QWORD *)&v27 + 1) = a1;
        *(_QWORD *)&v28 = v9;
        *((_QWORD *)&v28 + 1) = a2;
        LOWORD(Object) = 1;
        BYTE2(Object) = 6;
        DWORD1(Object) = 0;
        LOWORD(BugCheckParameter2.TargetInfoAsUlong) = 275;
        BugCheckParameter2.ProcessorHistory = 0i64;
        BugCheckParameter2.Number = v21 + 1280;
        KiInsertQueueDpc(&BugCheckParameter2, 0i64, 0i64, 0i64, 0);
        KeWaitForSingleObject(&Object, Executive, 0, 0, 0i64);
LABEL_25:
        _InterlockedOr(v23, 0);
        LOBYTE(v4) = KiAbCrossThreadRelease(a1, (unsigned __int64)v9, a2);
        return v4;
      }
      if( *(_BYTE *)(a2 + 113) )
      {
        KiReleaseThreadStateLock(v19, (__int64)ControlPrcb, (volatile signed __int64 *)ControlReadyQueue);
        KiReleaseThreadLockSafe(a2);
        __writecr8(CurrentIrql);
        KeGenericCallDpc((PKDEFERRED_ROUTINE)KeAbCrossThreadDeleteNopDpcRoutine, 0i64);
      }
      else
      {
        KiReleaseThreadStateLock(v19, (__int64)ControlPrcb, (volatile signed __int64 *)ControlReadyQueue);
        KiReleaseThreadLockSafe(a2);
        __writecr8(CurrentIrql);
      }
    }
    v9[2].m128i_i8[0] |= 1u;
    goto LABEL_25;
  }
  return v4;
}

Referenced by: