KeInsertQueueApc
UINT8 __stdcall KeInsertQueueApc(_KAPC *Apc, PVOID SystemArgument1, PVOID SystemArgument2, INT64 Increment){
UINT8 v7;
char ApcMode;
UINT8 v9;
bool v10;
_ETHREAD *Thread;
_ETHREAD *CurrentThread;
__int64 v13;
bool v14;
char v15;
UINT8 OldIrql;
_KPRCB *CurrentPrcb;
UINT8 v18;
UINT64 SpinCount;
void *NormalContext;
INT64 a3;
bool v23;
unsigned int Incrementa;
Incrementa = Increment;
v7 = EtwProviderEnabled(EtwThreatIntProvRegHandle, 0, 0x3000ui64);
ApcMode = Apc->ApcMode;
v9 = v7;
NormalContext = Apc->NormalContext;
v23 = ApcMode != 0;
a3 = (INT64)Apc->NormalRoutine;
v10 = (UINT8(__fastcall *)(KAPC *, INT64 *, INT64 *, PVOID *, INT64))Apc->KernelRoutine == KeSpecialUserApcKernelRoutine
&& !ApcMode;
Thread = Apc->Thread;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v13 = *((_QWORD *)Thread + 68);
if( ApcMode )
v14 = *((_QWORD *)CurrentThread + 68) == v13;
else
v14 = *((_QWORD *)CurrentThread + 23) == v13;
if( v9 && !v14 && (ApcMode || v10) )
{
v15 = 1;
ObfReferenceObjectWithTag(Apc->Thread, 0x5149654Bu);
}
else
{
v15 = 0;
}
OldIrql = KeGetCurrentIrql();
__writecr8(2ui64);
CurrentPrcb = KeGetCurrentPrcb();
LODWORD(SpinCount) = 0;
while( _interlockedbittestandset64((volatile signed __int32 *)Thread + 16, 0i64) )
{
do
KeYieldProcessorEx(&SpinCount);
while( *((_QWORD *)Thread + 8) );
}
if( (*((_DWORD *)Thread + 29) & 0x4000) == 0 || Apc->Inserted )
{
v18 = 0;
}
else
{
Apc->Inserted = 1;
Apc->SystemArgument1 = SystemArgument1;
Apc->SystemArgument2 = SystemArgument2;
KiInsertQueueApc(Apc);
KiSignalThreadForApc(CurrentPrcb, Apc, OldIrql);
v18 = 1;
}
KiReleaseThreadLockSafe((INT64)Thread);
KiExitDispatcher(CurrentPrcb, 0i64, AdjustUnwait, Incrementa, OldIrql);
if( v15 )
{
if( v18 )
EtwTiLogInsertQueueUserApc(
*((_BYTE *)KeGetCurrentThread() + 562),
(INT64)Thread,
a3,
NormalContext,
SystemArgument1,
SystemArgument2,
v23);
ObfDereferenceObjectWithTag(Thread, 0x5149654Bui64);
}
return v18;
}Referenced by:
CmpPostNotify
DbgkpLkmdLaunchSnapApc
EtwpCovSampCaptureQueueApc
EtwpEventWriteFull
EtwpQueueStackWalkApc
EtwpTraceThreadRundownWithStack
ExSwapinWorkerThreads
ExpTimerDpcRoutine
IoRaiseHardError
IoRaiseInformationalHardError
IopCancelIrpsInThreadList
IopCompleteRequest
IopfCompleteRequest
KeSpecialUserApcKernelRoutine
MiQueueSyncModifiedWriterApc
MiStoreModifiedWriteDereference
NtQueueApcThreadEx
PerfLogImageUnload
PspGetContextThreadInternal
PspRundownUmsThreadForApcDelivery
PspSetContextThreadInternal