PspGetPreviousProcessThread

__int64 __fastcall PspGetPreviousProcessThread(__int64 a1, _QWORD *a2){
  _ETHREAD *CurrentThread; 
  __int64 v3; 
  __int64 v5; 
  int v6; 
  INT64 *v7; 
  __int64 v8; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v3 = a1 + 1504;
  v5 = 0i64;
  v6 = 0;
  --*((_WORD *)CurrentThread + 242);
  v7 = (INT64 *)(a1 + 1080);
  ExAcquirePushLockSharedEx(a1 + 1080, 0i64);
  if( a2 )
    v8 = a2[158];
  else
    v8 = *(_QWORD *)(v3 + 8);
  while( v8 != v3 )
  {
    v5 = v8 - 1256;
    if( ObReferenceObjectSafeWithTag((PVOID)(v8 - 1256), 0x6E457350ui64) )
    {
      v6 = 1;
      break;
    }
    v8 = *(_QWORD *)(v8 + 8);
  }
  if( _InterlockedCompareExchange64(v7, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared(v7);
  KeAbPostRelease(v7);
  KeLeaveCriticalRegionThread((__int64)CurrentThread);
  if( a2 )
    ObfDereferenceObjectWithTag(a2, 0x6E457350ui64);
  return v5 & -(__int64)(v6 != 0);
}

Referenced by: