PsOpenThread

__int64 __fastcall PsOpenThread(VOID **a1, unsigned int a2, __int64 a3, _OWORD *a4, char a5, CHAR PreviousMode){
  int v10; 
  __int64 v11; 
  bool v12; 
  unsigned int v13; 
  char v14; 
  CHAR v15; 
  NTSTATUS v16; 
  INT8 v17; 
  _KPROCESSOR_MODE AccessMode; 
  char v20; 
  CHAR v21; 
  PETHREAD Thread; 
  _HANDLE ThreadId[4]; 
  unsigned int HandleAttributes; 
  unsigned int HandleAttributes_4; 
  _HANDLE v26; 
  unsigned int v27; 
  unsigned int v28; 
  _HANDLE v29; 
  _HANDLE v30; 
  unsigned int v31; 
  NTSTATUS v32; 
  VOID *Handle; 
  VOID **v34; 
  __int64 v35; 
  _SECURITY_SUBJECT_CONTEXT v36[5]; 
  _AUX_ACCESS_DATA AuxData; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  _HANDLE *v39; 
  __int64 v40; 
  unsigned int *v41; 
  __int64 v42; 
  int *v43; 
  __int64 v44; 
  _EVENT_DATA_DESCRIPTOR v45; 
  unsigned int *p_HandleAttributes_4; 
  __int64 v47; 
  _HANDLE *v48; 
  __int64 v49; 
  unsigned int *v50; 
  __int64 v51; 
  int *v52; 
  __int64 v53; 
  char *v54; 
  __int64 v55; 
  char *v56; 
  __int64 v57; 
  __int64 *v58; 
  __int64 v59; 

  v34 = a1;
  Handle = 0i64;
  Thread = 0i64;
  *(_OWORD *)ThreadId = 0i64;
  memset(v36, 0i64, sizeof(v36));
  memset(&AuxData, 0i64, sizeof(AuxData));
  v10 = 0;
  if( a5 )
  {
    v11 = (__int64)a1;
    if( (unsigned __int64)a1 >= 0x7FFFFFFF0000i64 )
      v11 = 0x7FFFFFFF0000i64;
    *(_QWORD *)v11 = *(_QWORD *)v11;
    if( (a3 & 3) == 0 )
    {
      v12 = *(_QWORD *)(a3 + 16) != 0i64;
      v13 = *(_DWORD *)(a3 + 24) & 0x1DF2;
      HandleAttributes = v13;
      if( !a4 )
      {
        v14 = 0;
        goto LABEL_8;
      }
      if( ((unsigned __int8)a4 & 3) == 0 )
      {
        *(_OWORD *)ThreadId = *a4;
        v14 = 1;
        v13 = HandleAttributes;
LABEL_8:
        v15 = PreviousMode;
        goto LABEL_11;
      }
    }
    ExRaiseDatatypeMisalignment();
  }
  v12 = *(_QWORD *)(a3 + 16) != 0i64;
  v15 = PreviousMode;
  v13 = *(_DWORD *)(a3 + 24) & (PreviousMode != 0 ? 7666 : 73714);
  if( a4 )
  {
    *(_OWORD *)ThreadId = *a4;
    v14 = 1;
  }
  else
  {
    v14 = 0;
  }
LABEL_11:
  if( v12 || !v14 )
  {
    v16 = -1073741776;
  }
  else
  {
    while( 1 )
    {
      v16 = SeCreateAccessState((_ACCESS_STATE *)v36, &AuxData, a2, (_GENERIC_MAPPING *)((char *)PsThreadType + 76));
      if( v16 < 0 )
        break;
      if( (v13 & 0x400) == 0 || (v17 = 1, v10) )
        v17 = v15;
      if( SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, v17) )
      {
        if( ((__int64)v36[0].PrimaryToken & 0x2000000) != 0 )
          HIDWORD(v36[0].PrimaryToken) |= 0x1FFFFFu;
        else
          HIDWORD(v36[0].PrimaryToken) |= LODWORD(v36[0].PrimaryToken);
        LODWORD(v36[0].PrimaryToken) = 0;
      }
      if( *(_QWORD *)ThreadId )
      {
        v16 = PsLookupProcessThreadByCid((__int64)ThreadId, 0i64, (PADAPTER_OBJECT *)&Thread);
        if( v16 < 0 )
        {
LABEL_27:
          SepDeleteAccessState((_ACCESS_STATE *)v36);
          SeReleaseSubjectContext(&v36[1]);
          break;
        }
      }
      else
      {
        v16 = PsLookupThreadByThreadId(*(VOID **)&ThreadId[2], &Thread);
        if( v16 < 0 )
          goto LABEL_27;
        *(_QWORD *)ThreadId = Thread->Cid.UniqueProcess;
      }
      LOBYTE(AccessMode) = v15;
      v16 = ObOpenObjectByPointer(Thread, v13, (PACCESS_STATE)v36, 0, (POBJECT_TYPE)PsThreadType, AccessMode, &Handle);
      SepDeleteAccessState((_ACCESS_STATE *)v36);
      SeReleaseSubjectContext(&v36[1]);
      HalPutDmaAdapter((PADAPTER_OBJECT)Thread);
      if( v16 >= 0 )
      {
        *v34 = Handle;
        if( v10 && *(&stru_140C00F40 + 732) > 5u && tlgKeywordOn((__int64)&stru_140C00F40 + 2928, 0x400000000000i64) )
        {
          HandleAttributes_4 = (unsigned int)PsGetThreadId(Thread);
          p_HandleAttributes_4 = &HandleAttributes_4;
          v47 = 4i64;
          v26 = ThreadId[0];
          v48 = &v26;
          v49 = 4i64;
          v27 = a2;
          v50 = &v27;
          v51 = 4i64;
          v28 = v13;
          v52 = (int *)&v28;
          v53 = 4i64;
          v20 = a5;
          v54 = &v20;
          v55 = 1i64;
          v21 = v15;
          v56 = &v21;
          v57 = 1i64;
          v35 = 0x1000000i64;
          v58 = &v35;
          v59 = 8i64;
          tlgWriteTransfer_EtwWriteTransfer(
            (__int64)&stru_140C00F40 + 2928,
            (unsigned __int8 *)byte_14002B200,
            0i64,
            0i64,
            9u,
            &v45);
        }
        break;
      }
      if( (v13 & 0x400) == 0 || v16 != -1073741790 || v10 )
        break;
      v10 = 1;
    }
  }
  v32 = v16;
  v31 = a2;
  v30 = ThreadId[2];
  v29 = ThreadId[0];
  UserData.Ptr = (unsigned __int64)&v29;
  *(_QWORD *)&UserData.Size = 4i64;
  v39 = &v30;
  v40 = 4i64;
  v41 = &v31;
  v42 = 4i64;
  v43 = &v32;
  v44 = 4i64;
  EtwWrite(*(&ExBootDevicesRemovedEvent + 379), &KERNEL_AUDIT_API_OPENTHREAD, 0, 4u, &UserData);
  return(unsigned int)v16;
}

Referenced by: