PspQueryLastCallThread

INT64 __stdcall PspQueryLastCallThread(
        _ETHREAD *Thread,
        PVOID ThreadInformation,
        UINT64 ThreadInformationLength,
        UINT64 *ReturnLength){
  int v5; 
  __int64 v6; 
  __int16 v7; 
  unsigned __int64 v8; 
  int v9; 
  signed __int32 v10[4]; 
  __int64 v11; 
  if( (((_DWORD)ThreadInformationLength - 16) & 0xFFFFFFF7) != 0 )
    return 3221225476i64;
  if( Thread == (_ETHREAD *)KeGetCurrentThread() )
    return 3221225485i64;
  v5 = *((_DWORD *)Thread + 85);
  _InterlockedOr(v10, 0);
  if( *((_BYTE *)Thread + 388) != 5 )
    return 3221225473i64;
  if( *((_BYTE *)Thread + 562) != 1 )
    return 3221225473i64;
  v6 = *((_QWORD *)Thread + 17);
  v7 = *((_WORD *)Thread + 64);
  v11 = *((unsigned int *)Thread + 109);
  _InterlockedOr(v10, 0);
  if( v5 != *((_DWORD *)Thread + 85) )
    return 3221225473i64;
  v8 = (unsigned int)(KUSER_SHARED_DATA.TickCount.LowPart - v11) * (unsigned __int64)KeMaximumIncrement;
  *(_QWORD *)ThreadInformation = v6;
  *((_WORD *)ThreadInformation + 4) = v7;
  v9 = 16;
  if( (_DWORD)ThreadInformationLength != 16 )
    *((_QWORD *)ThreadInformation + 2) = v8;
  if( ReturnLength )
  {
    if( (_DWORD)ThreadInformationLength != 16 )
      v9 = 24;
    *(_DWORD *)ReturnLength = v9;
  }
  return 0i64;
}

Referenced by: