KiDetachProcess

VOID __fastcall KiDetachProcess(KAPC_STATE *ApcState, UINT64 Force){
  INT64 *v2; 
  INT64 v3; 
  __int64 v4; 
  _ETHREAD *CurrentThread; 
  unsigned __int64 v6; 
  char v7; 
  volatile signed __int32 *v9; 
  int v10; 
  struct _KPRCB *CurrentPrcb; 
  _QWORD *v12; 
  _QWORD *v13; 
  _QWORD *v14; 
  __int64 v15; 
  _QWORD *v16; 
  struct _KPRCB *v17; 
  unsigned __int64 v18; 
  INT64 v19; 
  unsigned __int64 v20; 
  __int64 v21; 
  unsigned __int64 v22; 
  unsigned __int64 v23; 
  char v24; 
  unsigned __int8 v25; 
  unsigned __int32 v26; 
  unsigned __int32 v27; 
  signed __int64 *v28; 
  signed __int64 v29; 
  _QWORD *v30; 
  _QWORD *v31; 
  __int64 v32; 
  unsigned __int8 v33; 
  struct _KPRCB *v34; 
  __int64 v35; 
  int v36; 
  unsigned __int64 v37; 
  INT64 v38; 
  INT64 v39; 
  INT64 v40; 
  INT64 v41; 
  INT64 v42; 
  INT64 v43; 
  INT64 v44; 
  UINT64 SpinCount; 
  UINT64 v46; 
  __int64 CurrentIrql; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v6 = 2i64;
  v7 = Force;
  v9 = (volatile signed __int32 *)*((_QWORD *)CurrentThread + 23);
  v10 = Force & 2;
  if( (Force & 2) != 0 )
  {
    LOBYTE(v4) = 15;
    CurrentIrql = v4;
  }
  else
  {
    CurrentIrql = KeGetCurrentIrql();
    __writecr8(2ui64);
    CurrentPrcb = KeGetCurrentPrcb();
    LODWORD(SpinCount) = 0;
    while( _interlockedbittestandset64((volatile signed __int32 *)CurrentThread + 16, 0i64) )
    {
      do
        KeYieldProcessorEx(&SpinCount);
      while( *((_QWORD *)CurrentThread + 8) );
      v32 = *((_QWORD *)CurrentPrcb + 4247);
      if( v32 && *((_BYTE *)CurrentPrcb + 32) <= 1u )
        ++*(_DWORD *)(v32 + 24);
    }
    LOBYTE(v4) = CurrentIrql;
    v6 = 2i64;
  }
  if( *((_BYTE *)CurrentThread + 193) )
  {
    do
    {
      if( *((_WORD *)CurrentThread + 243) || (_BYTE)v4 )
        break;
      KiReleaseThreadLockSafe((INT64)CurrentThread);
      __writecr8((unsigned __int8)CurrentIrql);
      v33 = KeGetCurrentIrql();
      __writecr8(2ui64);
      CurrentIrql = v33;
      v34 = KeGetCurrentPrcb();
      LODWORD(v46) = 0;
      while( _interlockedbittestandset64((volatile signed __int32 *)CurrentThread + 16, 0i64) )
      {
        do
          KeYieldProcessorEx(&v46);
        while( *((_QWORD *)CurrentThread + 8) );
        v35 = *((_QWORD *)v34 + 4247);
        if( v35 && *((_BYTE *)v34 + 32) <= 1u )
        {
          v36 = *(_DWORD *)(v35 + 24) + 1;
          *(_DWORD *)(v35 + 24) = v36;
        }
      }
      LOBYTE(v4) = CurrentIrql;
    }
    while( *((_BYTE *)CurrentThread + 193) );
    v6 = 2i64;
  }
  if( !*((_BYTE *)CurrentThread + 586)
    || (*((_BYTE *)CurrentThread + 192) & 1) != 0
    || (v12 = (_QWORD *)((char *)CurrentThread + 152), (_QWORD *)*v12 != v12)
    || *((_ETHREAD **)CurrentThread + 21) != (_ETHREAD *)((char *)CurrentThread + 168) )
  {
    KeBugCheck(6ui64);
  }
  *((_DWORD *)CurrentThread + 29) |= 0x800u;
  v13 = (_QWORD *)((char *)CurrentThread + 600);
  if( ApcState == (KAPC_STATE *)((char *)CurrentThread + 600) )
  {
    *((_QWORD *)CurrentThread + 23) = *((_QWORD *)CurrentThread + 79);
    *((_BYTE *)CurrentThread + 192) = *((_BYTE *)CurrentThread + 640);
    *((_BYTE *)CurrentThread + 193) = *((_BYTE *)CurrentThread + 641);
    *((_BYTE *)CurrentThread + 194) = *((_BYTE *)CurrentThread + 642);
    v14 = (_QWORD *)*v13;
    if( (_QWORD *)*v13 == v13 )
    {
      *((_QWORD *)CurrentThread + 20) = (char *)CurrentThread + 152;
      *v12 = v12;
      *((_BYTE *)CurrentThread + 193) = 0;
    }
    else
    {
      v30 = (_QWORD *)*((_QWORD *)CurrentThread + 76);
      *v12 = v14;
      *((_QWORD *)CurrentThread + 20) = v30;
      v14[1] = v12;
      *v30 = v12;
    }
    v15 = *((_QWORD *)CurrentThread + 77);
    v16 = (_QWORD *)((char *)CurrentThread + 168);
    if( (_ETHREAD *)v15 == (_ETHREAD *)((char *)CurrentThread + 616) )
    {
      *((_QWORD *)CurrentThread + 22) = (char *)CurrentThread + 168;
      *v16 = v16;
      *((_BYTE *)CurrentThread + 194) = 0;
    }
    else
    {
      v31 = (_QWORD *)*((_QWORD *)CurrentThread + 78);
      *v16 = v15;
      *((_QWORD *)CurrentThread + 22) = v31;
      *(_QWORD *)(v15 + 8) = v16;
      *v31 = v16;
    }
    *((_QWORD *)CurrentThread + 79) = 0i64;
    *((_BYTE *)CurrentThread + 586) = 0;
  }
  else
  {
    KiMoveApcState(ApcState, (_KAPC_STATE *)((char *)CurrentThread + 152));
  }
  if( !v10 )
  {
    *((_QWORD *)CurrentThread + 8) = 0i64;
    v17 = KeGetCurrentPrcb();
    if( *((_QWORD *)v17 + 4247) )
    {
      if( *((_BYTE *)v17 + 32) <= 1u && !(_DWORD)v16 )
      {
        LOBYTE(v4) = CurrentIrql;
        v6 = 2i64;
      }
    }
  }
  v18 = (unsigned __int64)KeGetCurrentPrcb();
  v19 = *((_QWORD *)CurrentThread + 23);
  v20 = *(unsigned __int8 *)(v18 + 209);
  v21 = 8i64 * *(unsigned __int8 *)(v18 + 208) + 376;
  _interlockedbittestandset64((volatile signed __int32 *)(v21 + v19), v20);
  v22 = *(_QWORD *)(v19 + 40);
  if( (_BYTE)KiKvaShadow )
  {
    v23 = *(_QWORD *)(v19 + 40);
    if( (v22 & 2) != 0 )
      v23 = v22 | 0x8000000000000000ui64;
    __writegsqword(0x9000u, v23);
    KiSetAddressPolicy(*(_BYTE *)(v19 + 912));
    LOBYTE(v4) = CurrentIrql;
    v6 = 2i64;
  }
  __writecr3(v22);
  if( !KiFlushPcid && (_BYTE)KiKvaShadow )
  {
    v18 = __readcr4();
    if( (v18 & 0x20080) != 0 )
    {
      __writecr4(v18 ^ 0x80);
      __writecr4(v18);
    }
    else
    {
      v37 = __readcr3();
      __writecr3(v37);
    }
  }
  _interlockedbittestandreset64((volatile signed __int32 *)((char *)v9 + v21), v20);
  *((_DWORD *)CurrentThread + 29) &= ~0x800u;
  if( !v10 )
    __writecr8((unsigned __int8)v4);
  if( (v7 & 1) == 0 && (_InterlockedExchangeAdd(v9 + 210, 0xFFFFFFF8) & 0xFFFFFFF8) == 8 )
  {
    v24 = 0;
    v25 = KeGetCurrentIrql();
    __writecr8(v6);
    KiAcquireKobjectLockSafe((PVOID)v9);
    v26 = *((_DWORD *)v9 + 210);
    if( (v26 & 7) == 0 )
    {
      v18 = (unsigned __int64)(v9 + 12);
      if( *(_QWORD *)v18 != v18 && v26 < 8 )
      {
        while( 1 )
        {
          v18 = v26 & 0xFFFFFFF8 | 3;
          v27 = v26;
          v26 = _InterlockedCompareExchange(v9 + 210, v18, v26);
          if( v27 == v26 )
            break;
          if( v26 >= 8 )
            goto LABEL_36;
        }
        v24 = 1;
      }
    }
LABEL_36:
    _InterlockedAnd(v9, 0xFFFFFF7F);
    if( v24 )
    {
      v28 = (signed __int64 *)(v9 + 90);
      _m_prefetchw(&KiProcessOutSwapListHead);
      v29 = KiProcessOutSwapListHead;
      do
      {
        *v28 = v29;
        v18 = v29;
        v29 = _InterlockedCompareExchange64(&KiProcessOutSwapListHead, (signed __int64)v28, v29);
      }
      while( v29 != v18 );
      if( !v29 )
        KeSetEvent(&KiSwapEvent, 10);
    }
    __writecr8(v25);
  }
  if( (_QWORD *)*v12 != v12 )
  {
    LOBYTE(v18) = 1;
    *((_BYTE *)CurrentThread + 193) = 1;
    HalRequestSoftwareInterrupt((VOID *)v18, v19, v2, v3, v38, v39, v40, v41, v42, v43, v44);
  }
}

Referenced by: