PspThreadFromTicket

NTSTATUS __stdcall PspThreadFromTicket(_ALPC_WORK_ON_BEHALF_TICKET *Ticket, _ETHREAD **WOBThread){
  _ETHREAD **v2; 
  _ETHREAD *CurrentThread; 
  _ETHREAD *v4; 
  _EJOB *CurrentServerSilo; 
  bool v6; 
  int v8[10]; 
  __int64 v9; 

  v2 = WOBThread;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v9 = PspWorkOnBehalfEncodingKey ^ *(_QWORD *)Ticket;
  --CurrentThread->Tcb.SpecialApcDisable;
  LOBYTE(WOBThread) = 6;
  v4 = (_ETHREAD *)PspReferenceCidTableEntry((VOID *)(int)v9, (INT64)WOBThread);
  if( v4 )
  {
    CurrentServerSilo = PsGetCurrentServerSilo();
    if( (v4->CrossThreadFlags & 2) == 0 )
    {
      _InterlockedOr(v8, 0);
      if( (v4->ThreadLock._bf_0 & 1) != 0 )
        ExfAcquireReleasePushLockExclusive(&v4->ThreadLock);
      if( (v4->CrossThreadFlags & 2) == 0 )
        goto LABEL_7;
    }
    if( !PsIsProcessInSilo(v4->Tcb.Process, CurrentServerSilo) )
    {
LABEL_7:
      HalPutDmaAdapter((PADAPTER_OBJECT)v4);
      v4 = 0i64;
    }
  }
  v6 = CurrentThread->Tcb.SpecialApcDisable++ == -1;
  if( v6
    && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)CurrentThread->Tcb.ApcState.ApcListHead[0].Flink != &CurrentThread->Tcb.152 )
  {
    KiCheckForKernelApcDelivery();
  }
  if( !v4 )
    return -1073741813;
  *v2 = v4;
  if( v4->CreateTime.anonymous_0.LowPart == HIDWORD(v9) )
    return 0;
  HalPutDmaAdapter((PADAPTER_OBJECT)v4);
  return -1073741275;
}

Referenced by: