DbgkpPostFakeThreadMessages

NTSTATUS __stdcall DbgkpPostFakeThreadMessages(
        _EPROCESS *Process,
        _KEVENT *DebugObject,
        _EX_RUNDOWN_REF *StartThread,
        _EX_RUNDOWN_REF **pFirstThread,
        _EX_RUNDOWN_REF **pLastThread){
  _ETHREAD *NextProcessThread; 
  _EX_RUNDOWN_REF *v8; 
  _EX_RUNDOWN_REF *v9; 
  NTSTATUS v10; 
  bool v11; 
  char v12; 
  char v13; 
  void *SectionObject; 
  __int64 v15; 
  int v16; 
  bool v18; 
  _ETHREAD *CurrentThread; 
  _DBGKM_APIMSG DbgMsg[68]; 
  _KAPC_STATE ApcState; 

  NextProcessThread = (_ETHREAD *)StartThread;
  memset(&ApcState, 0, sizeof(ApcState));
  memset(DbgMsg, 0i64, sizeof(DbgMsg));
  v8 = 0i64;
  v9 = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v10 = -1073741823;
  if( NextProcessThread )
  {
    v8 = (_EX_RUNDOWN_REF *)NextProcessThread;
    ObfReferenceObjectWithTag(NextProcessThread, 0x4F676244ui64);
  }
  else
  {
    NextProcessThread = (_ETHREAD *)PsGetNextProcessThread(Process, 0i64);
  }
  v11 = StartThread == 0i64;
  v18 = StartThread == 0i64;
  while( NextProcessThread )
  {
    if( v9 )
      ObfDereferenceObjectWithTag(v9, 0x4F676244ui64);
    v9 = (_EX_RUNDOWN_REF *)NextProcessThread;
    ObfReferenceObjectWithTag(NextProcessThread, 0x4F676244ui64);
    if( (NextProcessThread->Tcb._bf_0 & 0x400) == 0 )
    {
      if( (NextProcessThread->CrossThreadFlags & 2) != 0
        || (PsSynchronizeWithThreadInsertion(NextProcessThread, CurrentThread),
            (NextProcessThread->CrossThreadFlags & 2) != 0) )
      {
        if( ExAcquireRundownProtection(&NextProcessThread->RundownProtect) )
        {
          v12 = 10;
          if( PsSuspendThread(NextProcessThread, 0i64) >= 0 )
            v12 = 42;
        }
        else
        {
          v12 = 18;
        }
        memset(DbgMsg, 0i64, sizeof(DbgMsg));
        if( !v11 || (v12 & 0x10) != 0 )
        {
          v13 = 0;
          DbgMsg[10] = 1;
          *(_QWORD *)&DbgMsg[14] = NextProcessThread->Win32StartAddress;
        }
        else
        {
          v13 = 1;
          DbgMsg[10] = 2;
          SectionObject = Process->SectionObject;
          if( SectionObject )
            *(_QWORD *)&DbgMsg[14] = DbgkpSectionToFileHandle(SectionObject);
          else
            *(_QWORD *)&DbgMsg[14] = 0i64;
          *(_QWORD *)&DbgMsg[16] = Process->SectionBaseAddress;
          KeStackAttachProcess(&Process->Pcb, &ApcState);
          LODWORD(v15) = RtlImageNtHeader((UINT64)Process->SectionBaseAddress);
          if( v15 )
          {
            *(_QWORD *)&DbgMsg[22] = 0i64;
            DbgMsg[18] = *(_DWORD *)(v15 + 12);
            DbgMsg[19] = *(_DWORD *)(v15 + 16);
          }
          KeUnstackDetachProcess(&ApcState);
        }
        DbgkpQueueMessage(Process, NextProcessThread);
        v10 = v16;
        if( v16 < 0 )
        {
          if( (v12 & 0x20) != 0 )
            PsResumeThread(NextProcessThread, 0i64);
          if( (v12 & 8) != 0 )
            ExReleaseRundownProtection(&NextProcessThread->RundownProtect);
          if( DbgMsg[10] == 2 && *(_QWORD *)&DbgMsg[14] )
            ObCloseHandle(*(VOID **)&DbgMsg[14], 0);
          PsQuitNextProcessThread(NextProcessThread);
          break;
        }
        if( v13 )
        {
          v11 = 0;
          v18 = 0;
          ObfReferenceObjectWithTag(NextProcessThread, 0x4F676244ui64);
          v8 = (_EX_RUNDOWN_REF *)NextProcessThread;
          DbgkSendSystemDllMessages(NextProcessThread, DebugObject, DbgMsg);
        }
        else
        {
          v11 = v18;
        }
      }
    }
    NextProcessThread = (_ETHREAD *)PsGetNextProcessThread(Process, NextProcessThread);
  }
  if( v10 >= 0 )
  {
    if( v8 )
    {
      *pFirstThread = v8;
      *pLastThread = v9;
    }
    else
    {
      if( v9 )
        ObfDereferenceObjectWithTag(v9, 0x4F676244ui64);
      return -1073741823;
    }
  }
  else
  {
    if( v8 )
      ObfDereferenceObjectWithTag(v8, 0x4F676244ui64);
    if( v9 )
      ObfDereferenceObjectWithTag(v9, 0x4F676244ui64);
  }
  return v10;
}

Referenced by: