NtSetContextThread

NTSTATUS __stdcall NtSetContextThread(PVOID ThreadHandle, _CONTEXT *ThreadContext){
  _ETHREAD *CurrentThread; 
  KPROCESSOR_MODE v4; 
  int v5; 
  _ETHREAD *v6; 
  __int64 v7; 
  __int64 v8; 
  __int64 v9; 
  int v11; 
  _ETHREAD *Thread; 
  EVENT_DATA_DESCRIPTOR UserData; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  Thread = 0i64;
  v4 = *((_BYTE *)CurrentThread + 562);
  v5 = ObReferenceObjectByHandle(ThreadHandle, 0x10u, (POBJECT_TYPE)PsThreadType, v4, (PVOID *)&Thread, 0i64);
  if( v5 >= 0 )
  {
    IoThreadToProcess(CurrentThread);
    v6 = Thread;
    v8 = v7;
    if( (*(_DWORD *)(v7 + 1120) & 0x20000) != 0 && (IoThreadToProcess(Thread), v8 == v9) )
    {
      v5 = -1073740278;
    }
    else if( (*((_DWORD *)v6 + 29) & 0x400) != 0 || *((_QWORD *)v6 + 188) )
    {
      v5 = -1073741816;
    }
    else
    {
      v5 = PspSetContextThreadInternal(v6, (__int64)ThreadContext, v4, v4, 1);
    }
    HalPutDmaAdapter((PADAPTER_OBJECT)v6);
  }
  UserData.Reserved = 0;
  UserData.Ptr = (unsigned __int64)&v11;
  v11 = v5;
  UserData.Size = 4;
  EtwWrite(EtwApiCallsProvRegHandle, (EVENT_DESCRIPTOR *)&KERNEL_AUDIT_API_SETCONTEXTTHREAD, 0i64, 1ui64, &UserData);
  return v5;
}

Referenced by: