KiDeliverApc

VOID __stdcall KiDeliverApc(CHAR PreviousMode, _KEXCEPTION_FRAME *ExceptionFrame, _KTRAP_FRAME *TrapFrame){
  _ETHREAD *CurrentThread; 
  bool v6; 
  __int64 v7; 
  _QWORD **v8; 
  struct _KPRCB *CurrentPrcb; 
  _QWORD *v10; 
  _QWORD *v11; 
  void(__fastcall *v12)(_QWORD *, void(__fastcall **)(__int64, __int64, __int64), __int64 *, __int64 *, __int64 *); 
  __int64 v13; 
  _QWORD *v14; 
  ULONG_PTR v15; 
  __int64 v16; 
  _QWORD *v17; 
  __int64 v18; 
  _QWORD **v19; 
  _QWORD *v20; 
  struct _KPRCB *v21; 
  char v22; 
  _QWORD *v23; 
  void(__fastcall *v24)(_QWORD *, void(__fastcall **)(__int64, __int64, __int64), __int64 *, __int64 *, __int64 *); 
  _QWORD *v25; 
  _QWORD *v26; 
  char v27; 
  char v28; 
  __int64 v29; 
  char v30; 
  _QWORD *v31; 
  int v32[8]; 
  void(__fastcall *v33)(__int64, __int64, __int64); 
  __int64 v34; 
  __int64 v35; 
  __int64 v36; 
  void(__fastcall *v37)(_QWORD *, void(__fastcall **)(__int64, __int64, __int64), __int64 *, __int64 *, __int64 *); 
  ULONG_PTR BugCheckParameter1; 
  UINT64 SpinCount; 
  UINT64 v41; 
  v36 = 0i64;
  v33 = 0i64;
  v35 = 0i64;
  v34 = 0i64;
  if( TrapFrame )
    KiCheckForSListAddress(TrapFrame);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v6 = *((_WORD *)CurrentThread + 243) == 0;
  v7 = *((_QWORD *)CurrentThread + 18);
  BugCheckParameter1 = *((_QWORD *)CurrentThread + 23);
  *((_QWORD *)CurrentThread + 18) = TrapFrame;
  *((_BYTE *)CurrentThread + 193) = 0;
  if( v6 )
  {
    _InterlockedOr(v32, 0);
    v8 = (_QWORD **)((char *)CurrentThread + 152);
    while( *v8 != v8 )
    {
      KeGetCurrentIrql();
      __writecr8(2ui64);
      CurrentPrcb = KeGetCurrentPrcb();
      LODWORD(SpinCount) = 0;
      while( _interlockedbittestandset64((volatile signed __int32 *)CurrentThread + 16, 0i64) )
      {
        do
          KeYieldProcessorEx(&SpinCount);
        while( *((_QWORD *)CurrentThread + 8) );
        v18 = *((_QWORD *)CurrentPrcb + 4247);
        if( v18 && *((_BYTE *)CurrentPrcb + 32) <= 1u )
          ++*(_DWORD *)(v18 + 24);
      }
      v10 = *v8;
      if( *v8 == v8 )
      {
        KiReleaseThreadLockSafe((INT64)CurrentThread);
        __writecr8(1ui64);
        break;
      }
      *((_BYTE *)CurrentThread + 193) = 0;
      v11 = v10 - 2;
      _m_prefetchw(v10 - 2);
      v12 = (void(__fastcall *)(_QWORD *, void(__fastcall **)(__int64, __int64, __int64), __int64 *, __int64 *, __int64 *))v10[2];
      v33 = (void(__fastcall *)(__int64, __int64, __int64))v10[4];
      v36 = v10[5];
      v35 = v10[6];
      v34 = v10[7];
      if( v33 )
      {
        if( *((_BYTE *)CurrentThread + 192) || *((_WORD *)CurrentThread + 242) )
        {
          KiReleaseThreadLockSafe((INT64)CurrentThread);
          __writecr8(1ui64);
          goto LABEL_14;
        }
        v16 = *v10;
        v17 = (_QWORD *)v10[1];
        if( *(_QWORD **)(*v10 + 8i64) != v10 || (_QWORD *)*v17 != v10 )
          goto LABEL_58;
        *v17 = v16;
        *(_QWORD *)(v16 + 8) = v17;
        *((_BYTE *)v11 + 82) = 0;
        KiReleaseThreadLockSafe((INT64)CurrentThread);
        __writecr8(1ui64);
        *((_BYTE *)CurrentThread + 192) = 1;
        v12(v11, &v33, &v36, &v35, &v34);
        if( v33 )
        {
          __writecr8(0i64);
          v33(v36, v35, v34);
          KeGetCurrentIrql();
          __writecr8(1ui64);
        }
        *((_BYTE *)CurrentThread + 192) = 0;
      }
      else
      {
        v13 = *v10;
        v14 = (_QWORD *)v10[1];
        if( *(_QWORD **)(*v10 + 8i64) != v10 || (_QWORD *)*v14 != v10 )
          goto LABEL_58;
        *v14 = v13;
        *(_QWORD *)(v13 + 8) = v14;
        *((_BYTE *)v11 + 82) = 0;
        *((_QWORD *)CurrentThread + 8) = 0i64;
        __writecr8(1ui64);
        *((_BYTE *)CurrentThread + 192) |= 2u;
        v12(v11, &v33, &v36, &v35, &v34);
        *((_BYTE *)CurrentThread + 192) &= ~2u;
      }
    }
    if( PreviousMode == 1 )
    {
      v19 = (_QWORD **)((char *)CurrentThread + 168);
      if( *v19 != v19 )
      {
        v37 = 0i64;
        v20 = 0i64;
        v33 = 0i64;
        v36 = 0i64;
        v35 = 0i64;
        v34 = 0i64;
        KeGetCurrentIrql();
        __writecr8(2ui64);
        v21 = KeGetCurrentPrcb();
        LODWORD(v41) = 0;
        while( _interlockedbittestandset64((volatile signed __int32 *)CurrentThread + 16, 0i64) )
        {
          do
            KeYieldProcessorEx(&v41);
          while( *((_QWORD *)CurrentThread + 8) );
          v29 = *((_QWORD *)v21 + 4247);
          if( v29 && *((_BYTE *)v21 + 32) <= 1u )
            ++*(_DWORD *)(v29 + 24);
        }
        v22 = *((_BYTE *)CurrentThread + 194);
        *((_BYTE *)CurrentThread + 194) = v22 & 0xFD;
        v23 = *v19;
        if( *v19 == v19 )
        {
          v24 = 0i64;
        }
        else
        {
          while( 1 )
          {
            v20 = v23 - 2;
            _m_prefetchw(v23 - 2);
            if( (UINT8(__fastcall *)(KAPC *, INT64 *, INT64 *, PVOID *, INT64))v23[2] == KeSpecialUserApcKernelRoutine
              || (v22 & 2) != 0 )
            {
              break;
            }
            v23 = (_QWORD *)*v23;
            v20 = 0i64;
            if( v23 == v19 )
            {
              v24 = v37;
              goto LABEL_36;
            }
          }
          v24 = (void(__fastcall *)(_QWORD *, void(__fastcall **)(__int64, __int64, __int64), __int64 *, __int64 *, __int64 *))v23[2];
          v33 = (void(__fastcall *)(__int64, __int64, __int64))v20[6];
          v36 = v20[7];
          v35 = v20[8];
          v34 = v20[9];
          v25 = (_QWORD *)*v23;
          v26 = (_QWORD *)v23[1];
          if( *(_QWORD **)(*v23 + 8i64) != v23 || (_QWORD *)*v26 != v23 )
LABEL_58:
            __fastfail(3u);
          *v26 = v25;
          v25[1] = v26;
          *((_BYTE *)v20 + 82) = 0;
          v27 = *((_BYTE *)CurrentThread + 194);
          if( (v27 & 1) != 0 )
          {
            v30 = v27 & 0xFE;
            *((_BYTE *)CurrentThread + 194) = v30;
            v31 = *v19;
            if( *v19 != v19 )
            {
              while( (UINT8(__fastcall *)(KAPC *, INT64 *, INT64 *, PVOID *, INT64))v31[2] != KeSpecialUserApcKernelRoutine )
              {
                v31 = (_QWORD *)*v31;
                if( v31 == v19 )
                  goto LABEL_36;
              }
              *((_BYTE *)CurrentThread + 194) = v30 | 1;
            }
          }
        }
LABEL_36:
        KiReleaseThreadLockSafe((INT64)CurrentThread);
        __writecr8(1ui64);
        if( v20 )
        {
          v24(v20, &v33, &v36, &v35, &v34);
          if( (v22 & 2) == 0 )
          {
            v28 = 0;
            goto LABEL_40;
          }
          if( v33 )
          {
            v28 = 1;
LABEL_40:
            KiInitializeUserApc((__int64)ExceptionFrame, (__int64)TrapFrame, (__int64)v33, v36, v35, v34, v28);
            goto LABEL_14;
          }
          KeTestAlertThread(1);
        }
      }
    }
  }
LABEL_14:
  v15 = *((_QWORD *)CurrentThread + 23);
  if( v15 != BugCheckParameter1 )
    KeBugCheckEx(
      5u,
      BugCheckParameter1,
      v15,
      *((unsigned __int8 *)CurrentThread + 586),
      *((_DWORD *)KeGetPcr() + 3243) & 0x10001);
  *((_QWORD *)CurrentThread + 18) = v7;
}

Referenced by: