ExpWorkerFactoryCreateThread

NTSTATUS __stdcall ExpWorkerFactoryCreateThread(_EX_WORKER_FACTORY *WorkerFactory){
  _EX_WORKER_FACTORY v1; 
  _ETHREAD *CurrentThread; 
  NTSTATUS v3; 
  int v4; 
  _EX_RUNDOWN_REF *v6; 
  _EX_WORKER_FACTORY v7; 
  NTSTATUS UserThread; 
  int v10; 
  __int64 v11[2]; 
  _KLOCK_QUEUE_HANDLE LockHandle; 
  VOID *ThreadHandle; 

  v1 = WorkerFactory[78];
  ThreadHandle = 0i64;
  memset(&LockHandle, 0, sizeof(LockHandle));
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v3 = 128;
  v4 = (v1 & 0x800 | 0x80u) >> 7;
  --CurrentThread->Tcb.KernelApcDisable;
  *(_OWORD *)v11 = 0i64;
  v6 = (_EX_RUNDOWN_REF *)(WorkerFactory + 26);
  if( ExAcquireRundownProtection((_EX_RUNDOWN_REF *)WorkerFactory + 13) )
  {
    KeAcquireInStackQueuedSpinLock(*((PKSPIN_LOCK *)WorkerFactory + 2), &LockHandle);
    if( !*(_BYTE *)(*((_QWORD *)WorkerFactory + 2) + 33i64) )
    {
      ++WorkerFactory[74];
      v7 = WorkerFactory[78];
      KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
      __writecr8(LockHandle.OldIrql);
      UserThread = RtlpCreateUserThreadEx(
                     *((VOID **)WorkerFactory + 5),
                     0i64,
                     v4,
                     0,
                     *((_QWORD *)WorkerFactory + 7),
                     *((_QWORD *)WorkerFactory + 8),
                     v10,
                     *((VOID **)WorkerFactory + 3),
                     *((VOID **)WorkerFactory + 4),
                     (__int64)&ThreadHandle,
                     (__int64)v11);
      WorkerFactory[80] = UserThread;
      v3 = UserThread;
      if( UserThread >= 0 )
      {
        if( (v7 & 0x8000) == 0 )
        {
          KeAcquireInStackQueuedSpinLock(*((PKSPIN_LOCK *)WorkerFactory + 2), &LockHandle);
          WorkerFactory[78] |= 0x8000u;
          KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
          __writecr8(LockHandle.OldIrql);
        }
        if( WorkerFactory[79] )
          ZwSetInformationThread((UINT64)ThreadHandle, 3i64, (UINT64)(WorkerFactory + 79), 4ui64);
        if( (WorkerFactory[78] & 0x4000) != 0 )
          ZwSetInformationThread(
            (UINT64)ThreadHandle,
            39i64,
            (UINT64)(WorkerFactory + 30),
            8 * (unsigned int)(unsigned __int16)KiActiveGroups);
        v3 = ZwResumeThread(ThreadHandle, 0i64);
        ObCloseHandle(ThreadHandle, 0);
        goto LABEL_11;
      }
      KeAcquireInStackQueuedSpinLock(*((PKSPIN_LOCK *)WorkerFactory + 2), &LockHandle);
      --WorkerFactory[74];
    }
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
    __writecr8(LockHandle.OldIrql);
LABEL_11:
    ExReleaseRundownProtection(v6);
  }
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  return v3;
}

Referenced by: