DbgkSendSystemDllMessages

VOID __fastcall DbgkSendSystemDllMessages(PVOID a1, _KEVENT *a2, _DWORD *a3){
  _ETHREAD *v4; 
  INT64 v5; 
  _DWORD *v6; 
  int i; 
  INT64 *SystemDllInfo; 
  INT64 *v9; 
  void *v10; 
  IMAGE_NT_HEADERS *v11; 
  _ETHREAD *CurrentThread; 
  int v13; 
  char v14; 
  __int64 v15; 
  INT64 *v17; 
  _KAPC_STATE ApcState; 
  v4 = (_ETHREAD *)a1;
  memset(&ApcState, 0, sizeof(ApcState));
  if( a1 )
    v5 = *((_QWORD *)a1 + 68);
  else
    v5 = *((_QWORD *)KeGetCurrentThread() + 23);
  v6 = a3 + 12;
  for( i = 0; i < 6; ++i )
  {
    SystemDllInfo = PsQuerySystemDllInfo(i);
    v9 = SystemDllInfo;
    v17 = SystemDllInfo;
    if( SystemDllInfo
      && (i <= 0
       || *((_WORD *)SystemDllInfo + 1) && *(_QWORD *)(v5 + 1408) && i == (unsigned int)PsWow64GetProcessNtdllType(v5)) )
    {
      *(_OWORD *)v6 = 0i64;
      *((_OWORD *)v6 + 1) = 0i64;
      v15 = 0i64;
      v10 = (void *)v9[3];
      *((_QWORD *)v6 + 1) = v10;
      if( v4 && i )
      {
        v14 = 1;
        KiStackAttachProcess((_KPROCESS *)v5, 0i64, &ApcState);
      }
      else
      {
        v14 = 0;
      }
      v11 = RtlImageNtHeader(v10);
      if( v11 )
      {
        v6[4] = v11->FileHeader.PointerToSymbolTable;
        v6[5] = v11->FileHeader.NumberOfSymbols;
      }
      if( !v4 )
      {
        CurrentThread = (_ETHREAD *)KeGetCurrentThread();
        if( (*((_DWORD *)CurrentThread + 29) & 0x400) != 0 || *((_BYTE *)CurrentThread + 586) == 1 )
          v15 = 0i64;
        else
          v15 = *((_QWORD *)CurrentThread + 30);
        if( v15 )
        {
          RtlStringCbCopyW((PWCHAR)(v15 + 4712), 0x20Aui64, (PWCHAR)v17[5]);
          *(_QWORD *)(v15 + 40) = v15 + 4712;
          *((_QWORD *)v6 + 3) = v15 + 40;
          v4 = (_ETHREAD *)a1;
        }
      }
      if( v14 )
        KiUnstackDetachProcess(&ApcState, 0i64);
      if( ZwOpenFile((UNICODE_STRING *)v6, (PWCHAR)0x80100000i64) < 0 )
        *(_QWORD *)v6 = 0i64;
      *a3 = 5242920;
      a3[1] = 8;
      a3[10] = 5;
      if( v4 )
      {
        DbgkpQueueMessage((_EPROCESS *)v5, v4);
        if( v13 < 0 && *(_QWORD *)v6 )
          ObCloseHandle(*(PVOID *)v6, 0);
      }
      else
      {
        DbgkpSendApiMessage((PVOID)v5, 3, (__int64)a3);
        if( *(_QWORD *)v6 )
          ObCloseHandle(*(PVOID *)v6, 0);
        if( v15 )
          *(_QWORD *)(v15 + 40) = 0i64;
      }
    }
  }
}

Referenced by: