KiInitializeUserApc

VOID __stdcall KiInitializeUserApc(
        _KEXCEPTION_FRAME *ExceptionFrame,
        _KTRAP_FRAME *TrapFrame,
        VOID *NormalRoutine,
        VOID *a4,
        VOID *a5,
        VOID *a6,
        VOID *NormalContext,
        VOID *SystemArgument1,
        VOID *SystemArgument2,
        INT64 a10,
        INT64 a11){
  UINT64 v12; 
  _ETHREAD *CurrentThread; 
  int v14; 
  INT64 v15; 
  unsigned __int64 Rsp; 
  _QWORD *v17; 
  int v18; 
  _DWORD *v19; 
  unsigned __int64 FaultAddress; 
  INT64 v21; 
  INT64 v22; 
  _QWORD *v23; 
  char *i; 
  unsigned int v25; 
  __int64 v26; 
  int v27; 
  int v28; 
  unsigned int Size; 
  unsigned __int64 v31; 
  _QWORD *v32; 
  _QWORD *v33; 
  __int64 v34; 
  _QWORD *v35; 
  _WORD v38[8]; 
  _ETHREAD *v39; 
  UINT64 UnbiasedInterruptTime; 
  _EXCEPTION_RECORD ExceptionRecord; 

  memset(&ExceptionRecord, 0i64, sizeof(ExceptionRecord));
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v39 = CurrentThread;
  if( ExceptionFrame )
  {
    v14 = 1048603;
    v28 = 1048603;
    v15 = 0i64;
    v34 = 0i64;
    if( (CurrentThread->Tcb._bf_0 & 0x100000) != 0 )
    {
      v14 = 1048667;
      v28 = 1048667;
      v15 = 2048i64;
      v34 = 2048i64;
    }
    Rsp = TrapFrame->_Rsp;
    v31 = Rsp;
    v17 = (_QWORD *)Rsp;
    v33 = (_QWORD *)Rsp;
    Size = 0;
    v18 = v14 & 0x100040;
    if( (v14 & 0x100040) == 1048640 )
    {
      Size = RtlpGetNonLegacyXStateAreaLength(v15);
      v17 = (_QWORD *)(((unsigned __int64)v17 - Size) & 0xFFFFFFFFFFFFFFC0ui64);
      v33 = v17;
      Rsp = v31;
    }
    v32 = (_QWORD *)((unsigned __int64)(v17 - 5) & 0xFFFFFFFFFFFFFFF0ui64);
    v35 = v32 - 4;
    v19 = v32 - 8;
    FaultAddress = (unsigned __int64)(v32 - 162);
    v21 = Rsp - (_QWORD)(v32 - 162);
    if( (unsigned __int64)(v21 - 1) > 0xFFE )
    {
      ProbeForWrite((UINT64)(v32 - 162), v21, 16i64);
    }
    else
    {
      if( FaultAddress >= 0x7FFFFFFF0000i64 )
        FaultAddress = 0x7FFFFFFF0000i64;
      *(_BYTE *)FaultAddress = *(_BYTE *)FaultAddress;
      *(_BYTE *)(FaultAddress + v21 - 1) = *(_BYTE *)(FaultAddress + v21 - 1);
      v19 = v32 - 8;
      v14 = v28;
      FaultAddress = (unsigned __int64)(v32 - 162);
      v32 = (_QWORD *)((unsigned __int64)(v17 - 5) & 0xFFFFFFFFFFFFFFF0ui64);
      v17 = v33;
      v15 = v34;
    }
    *(_OWORD *)v35 = 0i64;
    v35[2] = 0i64;
    *(_DWORD *)v35 = 1;
    *((_DWORD *)v35 + 1) = 2;
    if( ((unsigned __int8)NormalContext & 1) != 0 )
      *((_DWORD *)v35 + 1) = 3;
    if( v18 == 1048640 )
    {
      *v19 = -1232;
      v19[1] = LODWORD(TrapFrame->_Rsp) - FaultAddress;
      v19[2] = -1232;
      v19[3] = 1232;
      v19[4] = (_DWORD)v17 - (_DWORD)v19;
      v19[5] = LODWORD(TrapFrame->_Rsp) - (_DWORD)v17;
      memset(v17, 0i64, Size);
      if( (KUSER_SHARED_DATA.XState._bf_0 & 2) != 0 )
        v17[1] = v15 | 0x8000000000000000ui64;
    }
    *(_DWORD *)(FaultAddress + 48) = v14;
    KeContextFromKframes(TrapFrame, (_KTRAP_FRAME *)ExceptionFrame, (PCONTEXT)FaultAddress);
    v32[3] = *(_QWORD *)(FaultAddress + 152);
    v22 = *(_QWORD *)(FaultAddress + 248);
    *v32 = v22;
    KePopulateContinuationContext(v22);
  }
  else
  {
    FaultAddress = TrapFrame->FaultAddress;
    if( (CurrentThread->Tcb._bf_0 & 0x100000) != 0 )
    {
      v27 = KiUnwindUserSspForApcContextCopyBypass((_CONTEXT_EX *)FaultAddress);
      if( v27 < 0 )
        RtlRaiseStatus(v27);
    }
  }
  *(_QWORD *)FaultAddress = a4;
  *(_QWORD *)(FaultAddress + 8) = a5;
  *(_QWORD *)(FaultAddress + 16) = a6;
  *(_QWORD *)(FaultAddress + 24) = NormalRoutine;
  TrapFrame->_Rsp = FaultAddress;
  TrapFrame->_Rip = KeUserApcDispatcher;
  TrapFrame->SegCs = 51;
  if( TrapFrame->ExceptionActive != 2 )
    KiSetupForInstrumentationReturn(TrapFrame, v12);
  UnbiasedInterruptTime = KiQueryUnbiasedInterruptTime(1u);
  if( UnbiasedInterruptTime >= qword_140C4C530 )
  {
    __sidt(v38);
    v23 = *(_QWORD **)&v38[1];
    for( i = *(char **)&v38[1]; (unsigned __int64)i < *(_QWORD *)&v38[1] + 848i64; i += 64 )
      _mm_prefetchnta(i);
    v25 = 848;
    v26 = qword_140C4C520;
    while( v25 >= 8 )
    {
      v26 = __ROR8__(v26 - *v23++, qword_140C4C528);
      v25 -= 8;
    }
    while( v25 )
    {
      v26 = __ROR8__(v26 - *(unsigned __int8 *)v23, qword_140C4C528);
      v23 = (_QWORD *)((char *)v23 + 1);
      --v25;
    }
    if( qword_140C4C538 != v26 )
    {
      if( qword_140C4C4F0 )
        goto LABEL_29;
      qword_140C4C4F0 = (unsigned int)__ROR4__(150994945, 88);
      qword_140C4C4F8 = 0i64;
      qword_140C4C500 = 0i64;
      qword_140C4C508 = 269i64;
      qword_140C4C510 = *(_QWORD *)&v38[1];
    }
    if( !qword_140C4C4F0 )
    {
LABEL_28:
      qword_140C4C530 = KiQueryUnbiasedInterruptTime(1u)
                      + 41929663 * (__rdtsc() >> 4) % 0x12A05F2000i64
                      + 288000000000i64;
      return;
    }
LABEL_29:
    if( (VOID(__stdcall *)(_KDPC *, PVOID, PVOID, PVOID))stru_140C4C4B0.DeferredRoutine != KiScanQueues )
    {
      stru_140C4C4B0.TargetInfoAsUlong = 275;
      stru_140C4C4B0.DeferredRoutine = (void(__fastcall *)(_KDPC *, void *, void *, void *))KiScanQueues;
      stru_140C4C4B0.DeferredContext = &stru_140C4C4B0;
      stru_140C4C4B0.DpcData = 0i64;
      stru_140C4C4B0.ProcessorHistory = 0i64;
    }
    qword_140C4C518 = 940992i64;
    KeInsertQueueDpc((UINT64)&stru_140C4C4B0, 0i64, 0i64);
    goto LABEL_28;
  }
}

Referenced by: