NtQueryInformationThread
NTSTATUS __stdcall NtQueryInformationThread(
PVOID ThreadHandle,
THREADINFOCLASS ThreadInformationClass,
PVOID ThreadInformation,
UINT64 ThreadInformationLength,
UINT64 *ReturnLength){
__int64 v5;
__m128i *v6;
NTSTATUS v8;
_ETHREAD *CurrentThread;
KPROCESSOR_MODE v10;
int v11;
int v12;
__int64 v13;
NTSTATUS result;
PVOID v15;
__int32 v16;
char *v17;
__int64 v18;
__m128i v19;
_ETHREAD *WorkOnBehalfThread;
NTSTATUS v21;
PVOID v22;
struct _DMA_ADAPTER *v23;
NTSTATUS ContextThread;
PVOID v25;
void *v26;
_EPROCESS *v27;
UINT64 v28;
__int64 v29;
int v30;
int v31;
PVOID v32;
__int64 v33;
unsigned __int64 v34;
__int64 v35;
unsigned __int64 v36;
unsigned __int64 v37;
_LIST_ENTRY *v38;
struct _EX_RUNDOWN_REF *v39;
PVOID v40;
int v41;
unsigned __int8 *v42;
int v43;
PVOID v44;
PVOID v45;
UINT64 v46;
int v47;
unsigned int v48;
NTSTATUS v49;
unsigned int *v50;
unsigned __int64 ThreadStartAddress;
__int64 v52;
char v53;
INT64 v54;
_QWORD *v55;
char v56;
__int64 v57;
UINT8 *v58;
unsigned int v59;
__int64 v60;
PVOID Object;
char v62;
char v63;
KPROCESSOR_MODE v64;
NTSTATUS v65;
_PROCESSOR_NUMBER ProcessorNumber;
__int16 v67;
PVOID v68;
int v69;
int v70;
PVOID v71[2];
unsigned __int64 CycleTimeStamp;
_ALPC_WORK_ON_BEHALF_TICKET Ticket[2];
UINT64 *v74;
_ETHREAD *v75;
__m128i v76;
_QWORD a2[2];
__int128 v78;
__m128i v79;
int v80;
unsigned int v81;
unsigned int v82;
UINT8 *v83;
__int64 v84;
__int128 v85[2];
__m128i v86;
__m128i v87;
__m128i v88;
int v89;
__m128i v90;
__int64 Src[20];
v5 = (unsigned int)ThreadInformationLength;
v6 = (__m128i *)ThreadInformation;
v68 = ThreadHandle;
v74 = ReturnLength;
v8 = 0;
v84 = 0i64;
v88 = 0i64;
v89 = 0;
v76 = 0i64;
v90 = 0i64;
Object = 0i64;
CycleTimeStamp = 0i64;
memset(v85, 0, sizeof(v85));
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v75 = CurrentThread;
v71[1] = CurrentThread;
v10 = *((_BYTE *)CurrentThread + 562);
v64 = v10;
if( v10 )
{
v11 = 1;
if( ThreadInformationClass == (ThreadDescriptorTableEntry|0x20) )
{
v12 = 8;
}
else if( (unsigned int)v5 < 4 )
{
v12 = 1;
}
else
{
v12 = 4;
}
v69 = v12;
if( (_DWORD)v5 )
{
if( ((v12 - 1) & (unsigned int)ThreadInformation) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)ThreadInformation + v5 > 0x7FFFFFFF0000i64
|| (char *)ThreadInformation + v5 < ThreadInformation )
{
MEMORY[0x7FFFFFFF0000] = 0;
}
}
if( ReturnLength )
{
v13 = (__int64)ReturnLength;
if( (unsigned __int64)ReturnLength >= 0x7FFFFFFF0000i64 )
v13 = 0x7FFFFFFF0000i64;
*(_DWORD *)v13 = *(_DWORD *)v13;
}
}
else
{
v11 = 1;
}
HIDWORD(a2[0]) = 0;
v78 = 0i64;
v79 = 0ui64;
if( ThreadInformationClass != ThreadCycleTime )
{
if( ThreadInformationClass == ThreadActualBasePriority )
{
if( (_DWORD)v5 == 4 )
{
result = ObReferenceObjectByHandleWithTag(
ThreadHandle,
0x800u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
if( result < 0 )
return result;
v16 = *((char *)Object + 563);
ObfDereferenceObjectWithTag(Object, 0x79517350ui64);
v6->m128i_i32[0] = v16;
if( ReturnLength )
*(_DWORD *)ReturnLength = 4;
return 0;
}
}
else if( ThreadInformationClass == ThreadTimes )
{
if( (_DWORD)v5 == 32 )
{
result = ObReferenceObjectByHandleWithTag(
ThreadHandle,
0x800u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
if( result < 0 )
return result;
v87.m128i_i64[0] = KeMaximumIncrement * (unsigned __int64)*((unsigned int *)Object + 163);
v87.m128i_i64[1] = KeMaximumIncrement * (unsigned __int64)*((unsigned int *)Object + 183);
v86.m128i_i64[0] = *((_QWORD *)Object + 134);
if( *((_BYTE *)Object + 4) )
v86.m128i_i64[1] = *((_QWORD *)Object + 135);
else
v86.m128i_i64[1] = 0i64;
ObfDereferenceObjectWithTag(Object, 0x79517350ui64);
*v6 = v86;
v6[1] = v87;
if( ReturnLength )
*(_DWORD *)ReturnLength = 32;
return 0;
}
}
else
{
if( ThreadInformationClass )
{
switch( ThreadInformationClass )
{
case 6:
result = ObReferenceObjectByHandleWithTag(
ThreadHandle,
0x40u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
if( result < 0 )
return result;
v8 = xKdEnumerateDebuggingDevices(v27, v26, v28);
goto LABEL_111;
case 9:
if( (_DWORD)v5 != 8 )
return -1073741820;
v8 = ObReferenceObjectByHandleWithTag(
ThreadHandle,
0x40u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
if( v8 >= 0 )
{
v29 = *((_QWORD *)Object + 154);
ObfDereferenceObjectWithTag(Object, 0x79517350ui64);
v6->m128i_i64[0] = v29;
if( ReturnLength )
*(_DWORD *)ReturnLength = 8;
}
return v8;
case 11:
if( (_DWORD)v5 != 8 )
return -1073741820;
ContextThread = ObReferenceObjectByHandleWithTag(
ThreadHandle,
0x40u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
if( ContextThread >= 0 )
{
ObfDereferenceObjectWithTag(Object, 0x79517350ui64);
v6->m128i_i64[0] = 0i64;
if( ReturnLength )
*(_DWORD *)ReturnLength = 8;
}
return ContextThread;
case 12:
if( (_DWORD)v5 != 4 )
return -1073741820;
if( *(_DWORD *)(*((_QWORD *)CurrentThread + 68) + 1520i64) != 1 )
v11 = 0;
*(_DWORD *)ThreadInformation = v11;
if( ReturnLength )
*(_DWORD *)ReturnLength = 4;
return 0;
case 14:
if( (_DWORD)v5 != 4 )
return -1073741820;
ContextThread = ObReferenceObjectByHandleWithTag(
ThreadHandle,
0x800u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
if( ContextThread >= 0 )
{
v30 = (*((_DWORD *)Object + 30) >> 3) & 1;
ObfDereferenceObjectWithTag(Object, 0x79517350ui64);
v6->m128i_i32[0] = v30;
if( ReturnLength )
*(_DWORD *)ReturnLength = 4;
}
return ContextThread;
case 16:
if( (_DWORD)v5 != 4 )
return -1073741820;
result = ObReferenceObjectByHandleWithTag(
ThreadHandle,
0x40u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
if( result < 0 )
return result;
LOBYTE(v8) = *((_QWORD *)Object + 150) != (_QWORD)Object + 1200;
ObfDereferenceObjectWithTag(Object, 0x79517350ui64);
v6->m128i_i32[0] = v8;
if( ReturnLength )
*(_DWORD *)ReturnLength = 4;
return 0;
case 17:
if( (_DWORD)v5 != 1 )
return -1073741820;
result = ObReferenceObjectByHandleWithTag(
ThreadHandle,
0x40u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
v8 = result;
if( result < 0 )
return result;
v15 = Object;
v6->m128i_i8[0] = (*((_DWORD *)Object + 324) & 4) != 0;
if( ReturnLength )
*(_DWORD *)ReturnLength = 1;
goto LABEL_27;
case 18:
if( (_DWORD)v5 != 4 )
return -1073741820;
result = ObReferenceObjectByHandleWithTag(
ThreadHandle,
0x40u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
if( result < 0 )
return result;
v31 = (*((_DWORD *)Object + 324) >> 5) & 1;
ObfDereferenceObjectWithTag(Object, 0x79517350ui64);
v6->m128i_i32[0] = v31;
if( ReturnLength )
*(_DWORD *)ReturnLength = 4;
return 0;
case 20:
if( (_DWORD)v5 != 4 )
return -1073741820;
result = ObReferenceObjectByHandleWithTag(
ThreadHandle,
0x800u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
if( result < 0 )
return result;
if( (*((_DWORD *)Object + 324) & 1) == 0 )
v11 = 0;
ObfDereferenceObjectWithTag(Object, 0x79517350ui64);
v6->m128i_i32[0] = v11;
if( ReturnLength )
*(_DWORD *)ReturnLength = 4;
return 0;
case 21:
result = ObReferenceObjectByHandleWithTag(
ThreadHandle,
8u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
if( result < 0 )
return result;
v8 = PspQueryLastCallThread((_ETHREAD *)Object, v6, (unsigned int)v5, ReturnLength);
v15 = Object;
goto LABEL_27;
case 22:
if( (_DWORD)v5 != 4 )
return -1073741820;
result = ObReferenceObjectByHandleWithTag(
ThreadHandle,
0x800u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
v8 = result;
v65 = result;
if( result < 0 )
return result;
v15 = Object;
v6->m128i_i32[0] = (*((_DWORD *)Object + 324) >> 9) & 7;
if( ReturnLength )
*(_DWORD *)ReturnLength = 4;
goto LABEL_27;
case 24:
if( (_DWORD)v5 != 4 )
return -1073741820;
result = ObReferenceObjectByHandleWithTag(
ThreadHandle,
0x800u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
v8 = result;
if( result < 0 )
return result;
v15 = Object;
v6->m128i_i32[0] = (*((_DWORD *)Object + 324) >> 12) & 7;
if( ReturnLength )
*(_DWORD *)ReturnLength = 4;
goto LABEL_27;
case 26:
if( (_DWORD)v5 != 16 )
return -1073741820;
if( v10 )
{
v90 = *(__m128i *)ThreadInformation;
ProbeForWrite((VOID *)v90.m128i_i64[0], HIDWORD(_mm_srli_si128(v90, 8).m128i_u64[0]), 1ui64);
v6 = &v90;
v10 = v64;
}
v68 = v6;
result = ObReferenceObjectByHandleWithTag(
ThreadHandle,
0x18u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
v65 = result;
if( result < 0 )
return result;
v32 = Object;
if( (*((_DWORD *)Object + 29) & 0x400) != 0 )
{
ObfDereferenceObjectWithTag(Object, 0x79517350ui64);
return -1073741816;
}
else
{
v33 = *((_QWORD *)Object + 68);
v34 = 6200i64;
v35 = *(_QWORD *)(v33 + 1408);
if( v35 )
{
v34 = 12288i64;
if( *(_WORD *)(v35 + 8) == 0x8664 )
v34 = 14392i64;
}
v36 = v6->m128i_u32[3];
if( (_DWORD)v36 && (v37 = v6->m128i_u32[2], v37 < v34) && v36 <= v34 - v37 )
{
if( ExAcquireRundownProtection((PEX_RUNDOWN_REF)Object + 159) )
{
v38 = (_LIST_ENTRY *)*((_QWORD *)KeGetCurrentThread() + 23);
v39 = (struct _EX_RUNDOWN_REF *)Object;
if( (_LIST_ENTRY *)v33 == v38 )
{
memmove(
(UINT8 *)v6->m128i_i64[0],
(UINT8 *)(*((_QWORD *)Object + 30) + v6->m128i_u32[2]),
v6->m128i_u32[3]);
ContextThread = v65;
}
else
{
ContextThread = MmCopyVirtualMemory((_HHIVE *)v33, *((_QWORD *)Object + 30) + v6->m128i_u32[2], v38);
}
ExReleaseRundownProtection(v39 + 159);
ObfDereferenceObjectWithTag(v39, 0x79517350ui64);
if( ContextThread >= 0 )
{
if( ReturnLength )
*(_DWORD *)ReturnLength = v6->m128i_i32[3];
ContextThread = 0;
v65 = 0;
}
return ContextThread;
}
else
{
ObfDereferenceObjectWithTag(v32, 0x79517350ui64);
return -1073741749;
}
}
else
{
ObfDereferenceObjectWithTag(Object, 0x79517350ui64);
return -1073741811;
}
}
case 29:
result = ObReferenceObjectByHandleWithTag(
ThreadHandle,
8u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
if( result < 0 )
return result;
ContextThread = PspWow64GetContextThread((__int64)Object, v6->m128i_i32, v5, v64);
ObfDereferenceObjectWithTag(Object, 0x79517350ui64);
if( ContextThread >= 0 && ReturnLength )
*(_DWORD *)ReturnLength = 716;
return ContextThread;
case 30:
if( (_DWORD)v5 != 16 )
return -1073741820;
result = ObReferenceObjectByHandleWithTag(
ThreadHandle,
0x800u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
v8 = result;
if( result < 0 )
return result;
v25 = Object;
KeQueryAffinityThread((__int64)Object, (__int64)&v76);
*v6 = v76;
if( ReturnLength )
*(_DWORD *)ReturnLength = 16;
goto LABEL_108;
case 31:
if( (_DWORD)v5 != 24 )
return -1073741820;
v41 = *(_DWORD *)ThreadInformation;
v80 = *(_DWORD *)ThreadInformation;
v71[0] = 0i64;
result = ObReferenceObjectByHandle(ThreadHandle, 0x40u, (POBJECT_TYPE)PsThreadType, v10, v71, 0i64);
v8 = result;
if( result < 0 )
return result;
if( v41 == 3 )
{
*v6 = 0i64;
v6[1].m128i_i64[0] = 0i64;
v42 = (unsigned __int8 *)v71[0];
v43 = *((unsigned __int8 *)v71[0] + 3) >> 7;
v6->m128i_i32[2] = v43;
v6->m128i_i32[2] = v43 | (v42[3] >> 5) & 2;
}
else
{
v8 = -1073741811;
}
HalPutDmaAdapter((PADAPTER_OBJECT)v71[0]);
return v8;
case 32:
if( (_DWORD)v5 != 1 )
return -1073741820;
result = ObReferenceObjectByHandleWithTag(
ThreadHandle,
0x40u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
v8 = result;
if( result < 0 )
return result;
v40 = Object;
v6->m128i_i8[0] = *((_QWORD *)Object + 45) != 0i64;
ObfDereferenceObjectWithTag(v40, 0x79517350ui64);
if( v8 >= 0 && ReturnLength )
*(_DWORD *)ReturnLength = 1;
return v8;
case 33:
if( (_DWORD)v5 != 4 )
return -1073741820;
result = ObReferenceObjectByHandleWithTag(
ThreadHandle,
0x800u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
if( result < 0 )
return result;
ProcessorNumber = (_PROCESSOR_NUMBER)0x400000;
KeSetIdealProcessorThreadByNumber((_KTHREAD *)Object, &ProcessorNumber, &ProcessorNumber);
ObfDereferenceObjectWithTag(Object, 0x79517350ui64);
*(_PROCESSOR_NUMBER *)v6->m128i_i8 = ProcessorNumber;
if( ReturnLength )
*(_DWORD *)ReturnLength = 4;
return 0;
case 34:
if( !(_DWORD)v5 )
return -1073741820;
result = ObReferenceObjectByHandleWithTag(
ThreadHandle,
0x40u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
v65 = result;
if( result < 0 )
return result;
v6->m128i_i8[0] = *((_QWORD *)Object + 13) != 0i64;
if( ReturnLength )
*(_DWORD *)ReturnLength = 1;
v8 = v65;
goto LABEL_111;
case 35:
if( (_DWORD)v5 != 4 )
return -1073741820;
result = ObReferenceObjectByHandleWithTag(
ThreadHandle,
0x800u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
v8 = result;
if( result < 0 )
return result;
v44 = Object;
v6->m128i_i32[0] = *((char *)Object + 644) + ((*((_DWORD *)Object + 30) >> 14) & 1);
if( ReturnLength )
*(_DWORD *)ReturnLength = 4;
v15 = v44;
goto LABEL_27;
case 36:
if( (_DWORD)v5 != 4 )
return -1073741820;
ContextThread = ObReferenceObjectByHandleWithTag(
ThreadHandle,
0x800u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
if( ContextThread >= 0 )
{
v45 = Object;
v6->m128i_i32[0] = KeQueryHeteroCpuPolicyThread((_KTHREAD *)Object, 1ui64);
if( ReturnLength )
*(_DWORD *)ReturnLength = 4;
ObfDereferenceObjectWithTag(v45, 0x79517350ui64);
}
return ContextThread;
case 37:
if( (_DWORD)v5 != 16 )
return -1073741820;
if( ThreadHandle != (PVOID)-2i64 )
return -1073741811;
result = PsGetEffectiveContainerId(4, (__int64)CurrentThread, (__int64)&v88);
if( result >= 0 )
{
*v6 = v88;
if( ReturnLength )
*(_DWORD *)ReturnLength = 16;
}
return result;
case 38:
v53 = 0;
v63 = 0;
v62 = 0;
v47 = ObReferenceObjectByHandleWithTag(
ThreadHandle,
0x800u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
v65 = v47;
if( v47 < 0 )
{
v55 = Object;
v56 = v62;
v60 = (__int64)v75;
}
else
{
v53 = 1;
v63 = 1;
v54 = (INT64)CurrentThread;
v55 = Object;
PspLockThreadSecurityShared((INT64)Object, v54);
v56 = 1;
v62 = 1;
v57 = v55[194];
if( v57 )
{
v58 = *(UINT8 **)(v57 + 8);
LOWORD(v8) = *(_WORD *)v57;
}
else
{
v58 = (UINT8 *)&word_1407CF120;
}
v67 = v8;
v83 = v58;
v59 = (unsigned __int16)v8 + 16;
LODWORD(v68) = v59;
v82 = v59;
if( v59 <= (unsigned int)v5 )
{
memmove((UINT8 *)&v6[1], v58, (unsigned __int16)v8);
v6->m128i_i16[0] = v8;
v6->m128i_i16[1] = v8;
v6->m128i_i64[1] = (__int64)v6[1].m128i_i64;
v59 = (unsigned int)v68;
v53 = v63;
v56 = v62;
}
else
{
v47 = -1073741789;
v65 = -1073741789;
}
if( ReturnLength )
*(_DWORD *)ReturnLength = v59;
v60 = (__int64)v75;
}
if( v56 )
PspUnlockThreadSecurityShared((__int64)v55, v60);
if( v53 )
ObfDereferenceObjectWithTag(v55, 0x79517350ui64);
return v47;
case 39:
if( (v5 & 7) != 0 || (unsigned int)v5 > 0xA0 )
return -1073741820;
v47 = ObReferenceObjectByHandleWithTag(
ThreadHandle,
0x800u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
v65 = v47;
if( v47 >= 0 )
{
v48 = 8 * KeQueryCpuSetsThread((_KTHREAD *)Object, (UINT64 *)Src, v46);
ObfDereferenceObjectWithTag(Object, 0x79517350ui64);
v81 = v48;
if( ReturnLength )
*(_DWORD *)ReturnLength = v48;
if( v48 >= (unsigned int)v5 )
v48 = v5;
memmove((UINT8 *)v6, (UINT8 *)Src, v48);
}
return v47;
case 40:
if( (_DWORD)v5 != 80 )
return -1073741820;
result = ObReferenceObjectByHandleWithTag(
ThreadHandle,
0x800u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
v49 = result;
if( result >= 0 )
{
v50 = (unsigned int *)Object;
KeQueryValuesThread((__int64)Object, (__int64)v85);
ThreadStartAddress = PsQueryThreadStartAddress((__int64)v50, 1);
if( ThreadStartAddress > 0x7FFFFFFEFFFFi64 )
ThreadStartAddress = 0i64;
v6[4].m128i_i32[1] = BYTE8(v85[0]);
v6[4].m128i_i32[2] = BYTE9(v85[0]);
v6[3].m128i_i32[3] = SBYTE11(v85[0]);
v6[3].m128i_i32[2] = SBYTE10(v85[0]);
v6[1].m128i_i32[2] = v85[0];
v52 = KeMaximumIncrement;
v6->m128i_i64[0] = KeMaximumIncrement * (unsigned __int64)v50[163];
v6->m128i_i64[1] = v52 * v50[183];
v6[1].m128i_i64[0] = *((_QWORD *)v50 + 134);
v6[4].m128i_i32[0] = v50[85];
*(__m128i *)((char *)v6 + 40) = *(__m128i *)(v50 + 286);
v6[2].m128i_i64[0] = ThreadStartAddress;
if( ReturnLength )
*(_DWORD *)ReturnLength = 80;
ObfDereferenceObjectWithTag(v50, 0x79517350ui64);
return v49;
}
return result;
case 41:
if( (_DWORD)v5 != 16 )
return -1073741820;
result = ObReferenceObjectByHandleWithTag(
ThreadHandle,
0x800u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
v8 = result;
if( result < 0 )
return result;
v25 = Object;
KeQueryActualAffinityThread((__int64)Object, (__int64)&v76);
*v6 = v76;
if( ReturnLength )
*(_DWORD *)ReturnLength = 16;
LABEL_108:
ObfDereferenceObjectWithTag(v25, 0x79517350ui64);
return v8;
case 42:
if( (_DWORD)v5 != 4 )
return -1073741820;
result = ObReferenceObjectByHandleWithTag(
ThreadHandle,
0x800u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
v21 = result;
if( result < 0 )
return result;
v22 = Object;
v6->m128i_i32[0] = (*((_DWORD *)Object + 324) & 0x40000) != 0;
if( ReturnLength )
*(_DWORD *)ReturnLength = 4;
goto LABEL_72;
case 43:
if( (_DWORD)v5 != 4 )
return -1073741820;
result = ObReferenceObjectByHandleWithTag(
ThreadHandle,
0x800u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
v65 = result;
if( result < 0 )
return result;
v6->m128i_i32[0] = (*((_DWORD *)Object + 324) >> 19) & 1;
if( ReturnLength )
*(_DWORD *)ReturnLength = 4;
v8 = v65;
LABEL_111:
v15 = Object;
goto LABEL_27;
case 44:
v70 = 0;
if( (_DWORD)v5 != 16 )
return -1073741820;
if( ThreadHandle != (PVOID)-2i64 )
return -1073741811;
*(_OWORD *)&Ticket[0].ThreadId = 0i64;
WorkOnBehalfThread = (_ETHREAD *)PsGetWorkOnBehalfThread((__int64)CurrentThread, &v70);
if( WorkOnBehalfThread )
{
PsEncodeThreadWorkOnBehalfTicket(WorkOnBehalfThread, Ticket);
if( v70 )
HalPutDmaAdapter(v23);
}
else
{
PsEncodeThreadWorkOnBehalfTicket(CurrentThread, Ticket);
Ticket[1].ThreadId |= 1u;
}
*v6 = *(__m128i *)&Ticket[0].ThreadId;
if( ReturnLength )
*(_DWORD *)ReturnLength = 16;
return 0;
case 45:
if( (_DWORD)v5 != 4 )
return -1073741820;
result = ObReferenceObjectByHandleWithTag(
ThreadHandle,
0x800u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
v21 = result;
if( result < 0 )
return result;
v22 = Object;
if( *((_QWORD *)Object + 188) )
v8 = qword_140C1DE90;
v6->m128i_i32[0] = v8;
if( ReturnLength )
*(_DWORD *)ReturnLength = 4;
LABEL_72:
ObfDereferenceObjectWithTag(v22, 0x79517350ui64);
result = v21;
break;
default:
return -1073741821;
}
return result;
}
if( (_DWORD)v5 == 48 )
{
result = ObReferenceObjectByHandleWithTag(
ThreadHandle,
0x800u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
if( result < 0 )
return result;
v17 = (char *)Object;
if( *((_BYTE *)Object + 4) )
LODWORD(a2[0]) = PsGetThreadExitStatus((PETHREAD)Object);
else
LODWORD(a2[0]) = 259;
a2[1] = *((_QWORD *)v17 + 30);
IoThreadToProcess((_ETHREAD *)v17);
if( (*(_BYTE *)(v18 + 992) & 1) != 0 )
VslGetSecureTebAddress((INT64)v17, &a2[1]);
v19 = *(__m128i *)(v17 + 1144);
v79.m128i_i64[0] = *((_QWORD *)v17 + 69);
v79.m128i_i32[2] = v17[195];
v79.m128i_i32[3] = KeQueryBasePriorityThread((_KTHREAD *)v17);
ObfDereferenceObjectWithTag(v17, 0x79517350ui64);
*v6 = *(__m128i *)a2;
v6[1] = v19;
v6[2] = v79;
if( ReturnLength )
*(_DWORD *)ReturnLength = 48;
return 0;
}
}
return -1073741820;
}
if( (_DWORD)v5 != 16 )
return -1073741820;
if( ThreadHandle == (PVOID)-2i64 )
{
Object = CurrentThread;
}
else
{
result = ObReferenceObjectByHandleWithTag(
ThreadHandle,
0x800u,
(POBJECT_TYPE)PsThreadType,
v10,
0x79517350u,
&Object,
0i64);
v8 = result;
if( result < 0 )
return result;
CurrentThread = (_ETHREAD *)Object;
}
v6->m128i_i64[0] = KeQueryTotalCycleTimeThread((_KTHREAD *)CurrentThread, &CycleTimeStamp);
v6->m128i_i64[1] = CycleTimeStamp;
if( ReturnLength )
*(_DWORD *)ReturnLength = 16;
if( ThreadHandle != (PVOID)-2i64 )
{
v15 = CurrentThread;
LABEL_27:
ObfDereferenceObjectWithTag(v15, 0x79517350ui64);
}
return v8;
}Referenced by:
No references.