KeStackAttachProcess

VOID __stdcall KeStackAttachProcess(_EPROCESS *PROCESS, PRKAPC_STATE ApcState){
  _ETHREAD *CurrentThread; 
  unsigned __int8 CurrentIrql; 
  struct _KPRCB *CurrentPrcb; 
  __int64 v7; 
  UINT64 SpinCount; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  if( (*((_DWORD *)KeGetPcr() + 3243) & 0x10001) != 0 || (*((_DWORD *)PROCESS + 158) & 0x400) != 0 )
    KeBugCheckEx(
      5u,
      (ULONG_PTR)PROCESS,
      *((_QWORD *)CurrentThread + 23),
      *((unsigned __int8 *)CurrentThread + 586),
      *((_DWORD *)KeGetPcr() + 3243) & 0x10001);
  if( *((_EPROCESS **)CurrentThread + 23) == PROCESS )
  {
    ApcState->Process = (_EPROCESS *)1;
  }
  else
  {
    CurrentIrql = KeGetCurrentIrql();
    __writecr8(2ui64);
    CurrentPrcb = KeGetCurrentPrcb();
    LODWORD(SpinCount) = 0;
    while( _interlockedbittestandset64((volatile signed __int32 *)CurrentThread + 16, 0i64) )
    {
      do
        KeYieldProcessorEx(&SpinCount);
      while( *((_QWORD *)CurrentThread + 8) );
      v7 = *((_QWORD *)CurrentPrcb + 4247);
      if( v7 && *((_BYTE *)CurrentPrcb + 32) <= 1u )
        ++*(_DWORD *)(v7 + 24);
    }
    if( *((_BYTE *)CurrentThread + 586) )
    {
      KiAttachProcess((__int64)CurrentThread, (__int64)PROCESS, CurrentIrql, 0, (__int64)ApcState);
    }
    else
    {
      KiAttachProcess((__int64)CurrentThread, (__int64)PROCESS, CurrentIrql, 0, (__int64)CurrentThread + 600);
      ApcState->Process = 0i64;
    }
  }
}

Referenced by: